theory Ipc_C

lemma receiveIPC_ccorres [corres]:
  notes option.case_cong_weak [cong]
  shows
  "ccorres dc xfdc (invs' and st_tcb_at' simple' thread and sch_act_not thread
                          and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))
                          and valid_cap' cap and K (isEndpointCap cap))
     (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>
           \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>
           \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>) hs
     (receiveIPC thread cap isBlocking)
     (Call receiveIPC_'proc)" unfolding K_def apply (rule ccorres_gen_asm) apply (cinit lift: thread_' cap_' isBlocking_') apply (rule ccorres_pre_getEndpoint) apply (rename_tac ep) apply (simp only: ccorres_seq_skip) apply (rule_tac xf'=ret__unsigned_'
               and val="capEPPtr cap"
               and R=\<top>
                in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply (clarsimp simp: cap_get_tag_isCap isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (simp add: cap_endpoint_cap_lift ccap_relation_def cap_to_H_def) apply ceqv apply csymbr apply (rule ccorres_move_c_guard_tcb) apply (rule_tac xf'=ntfnPtr_'
                and r'="\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0"
                in ccorres_split_nothrow_novcg) apply (simp add: getBoundNotification_def) apply (rule_tac P="no_0_obj' and valid_objs'" in threadGet_vcg_corres_P) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (drule obj_at_ko_at', clarsimp) apply (drule spec, drule(1) mp, clarsimp) apply (clarsimp simp: typ_heap_simps ctcb_relation_def) apply (drule(1) ko_at_valid_objs', simp add: projectKOs) apply (clarsimp simp: option_to_ptr_def option_to_0_def projectKOs
                              valid_obj'_def valid_tcb'_def) apply ceqv apply (rename_tac ntfnptr ntfnptr') apply (simp del: Collect_const split del: if_split cong: call_ignore_cong) apply (rule ccorres_rhs_assoc2) apply (rule_tac xf'=ret__int_'
                   and r'="\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> isActive rv)"
                    in ccorres_split_nothrow_novcg) apply wpc apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: option_to_ptr_def option_to_0_def in_monad Bex_def) apply (rule ccorres_pre_getNotification[where f=return, simplified]) apply (rule_tac P="\<lambda>s. ko_at' rv (the ntfnptr) s"
                     in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: option_to_ptr_def option_to_0_def in_monad Bex_def) apply (erule cmap_relationE1[OF cmap_relation_ntfn]) apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps cnotification_relation_def Let_def
                                notification_state_defs isActive_def
                         split: Structures_H.ntfn.split_asm Structures_H.notification.splits) apply ceqv apply (rule ccorres_cond[where R=\<top>]) apply (simp add: Collect_const_mem) apply (ctac add: completeSignal_ccorres) apply (rule_tac xf'=ret__unsigned_'
                    and val="case ep of IdleEP \<Rightarrow> scast EPState_Idle
                            | RecvEP _ \<Rightarrow> scast EPState_Recv
                            | SendEP _ \<Rightarrow> scast EPState_Send"
                    and R="ko_at' ep (capEPPtr cap)"
                    in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (vcg, clarsimp) apply (erule cmap_relationE1 [OF cmap_relation_ep]) apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps cendpoint_relation_def Let_def
                          split: endpoint.split_asm) apply ceqv apply (rule_tac A="invs' and st_tcb_at' simple' thread
                                  and sch_act_not thread
                              and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))
                                  and ko_at' ep (capEPPtr cap)"
                     in ccorres_guard_imp2 [where A'=UNIV]) apply wpc
            \<comment> \<open>RecvEP case\<close> apply (rule ccorres_cond_true) apply csymbr apply (simp only: case_bool_If from_bool_neq_0) apply (rule ccorres_Cond_rhs, simp cong: Collect_cong split del: if_split) apply (intro ccorres_rhs_assoc) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (rule receiveIPC_block_ccorres_helper[unfolded ptr_val_def, simplified]) apply ceqv apply simp apply (rename_tac list NOo) apply (rule_tac ep="RecvEP list" in receiveIPC_enqueue_ccorres_helper[simplified]) apply (simp add: valid_ep'_def) apply (wp sts_st_tcb') apply (rename_tac list) apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs) apply (clarsimp simp: guard_is_UNIV_def) apply simp apply (ctac add: doNBRecvFailedTransfer_ccorres)
           \<comment> \<open>IdleEP case\<close> apply (rule ccorres_cond_true) apply csymbr apply (simp only: case_bool_If from_bool_neq_0) apply (rule ccorres_Cond_rhs, simp cong: Collect_cong split del: if_split) apply (intro ccorres_rhs_assoc) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (rule receiveIPC_block_ccorres_helper[unfolded ptr_val_def, simplified]) apply ceqv apply simp apply (rule_tac ep=IdleEP in receiveIPC_enqueue_ccorres_helper[simplified]) apply (simp add: valid_ep'_def) apply (wp sts_st_tcb') apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs) apply (clarsimp simp: guard_is_UNIV_def) apply simp apply (ctac add: doNBRecvFailedTransfer_ccorres)
          \<comment> \<open>SendEP case\<close> apply (thin_tac "isBlockinga = from_bool P" for P) apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply (intro ccorres_rhs_assoc) apply (csymbr, csymbr, csymbr, csymbr, csymbr) apply wpc apply (simp only: haskell_fail_def) apply (rule ccorres_fail) apply (rename_tac sender rest) apply csymbr apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply simp apply (rule_tac sender=sender in receiveIPC_dequeue_ccorres_helper[simplified]) apply ceqv apply (rename_tac sender') apply (simp only: K_bind_def haskell_assert_def return_bind) apply (rule ccorres_move_c_guard_tcb) apply (rule getThreadState_ccorres_foo) apply (rename_tac sendState) apply (rule ccorres_assert) apply (rule ccorres_rhs_assoc2) apply (rule_tac val="blockingIPCBadge sendState"
                        and xf'=badge_'
                        and R="\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState"
                         in ccorres_symb_exec_r_known_rv_UNIV [where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_tcb]) apply (clarsimp simp: ctcb_relation_def typ_heap_simps
                                     cthread_state_relation_def word_size
                                     isSend_def thread_state_lift_def
                              split: Structures_H.thread_state.splits) apply ceqv apply (simp split del: if_split) apply (rule ccorres_move_c_guard_tcb) apply (rule ccorres_rhs_assoc2) apply (rule_tac val="from_bool (blockingIPCCanGrant sendState)"
                         and xf'=canGrant_'
                         and R="\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState"
                          in ccorres_symb_exec_r_known_rv_UNIV [where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_tcb]) apply (clarsimp simp: ctcb_relation_def typ_heap_simps
                                      cthread_state_relation_def word_size
                                      isSend_def thread_state_lift_def
                               split: Structures_H.thread_state.splits) apply ceqv apply (rule ccorres_rhs_assoc2) apply (rule_tac xf'=canGrantReply_'
                       and val="from_bool (blockingIPCCanGrantReply sendState)"
                       and R="st_tcb_at' ((=) sendState) sender" and R'=UNIV
                       in ccorres_symb_exec_r_known_rv_UNIV) apply (clarsimp, rule conseqPre, vcg) apply (fastforce simp: pred_tcb_at'_def tcb_at_h_t_valid typ_heap_simps'
                                  dest: obj_at_cslift_tcb ctcb_relation_blockingIPCCanGrantReplyD) apply ceqv apply (ctac(no_vcg)) apply (rule ccorres_move_c_guard_tcb) apply (rule ccorres_rhs_assoc2) apply (rule_tac val="from_bool (blockingIPCIsCall sendState)"
                            and xf'=do_call_'
                            and R="\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState"
                             in ccorres_symb_exec_r_known_rv_UNIV [where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_tcb]) apply (clarsimp simp: ctcb_relation_def typ_heap_simps
                                         cthread_state_relation_def word_size
                                         isSend_def thread_state_lift_def
                                  split: Structures_H.thread_state.splits) apply ceqv apply (clarsimp simp:  from_bool_0 disj_imp[symmetric] simp del: Collect_const) apply wpc 
                  (* blocking ipc call *)
                   apply (clarsimp split del: if_split simp del: Collect_const) apply ccorres_rewrite apply (wpc ; clarsimp ; ccorres_rewrite) apply csymbr apply clarsimp apply ctac apply ctac 
                 (* non-blocking ipc call *)
                  apply (clarsimp simp:  from_bool_0 disj_imp[symmetric] simp del: Collect_const) apply ccorres_rewrite apply ctac apply (ctac add: possibleSwitchTo_ccorres) apply (wpsimp wp: sts_st_tcb' sts_valid_queues) apply (vcg exspec=setThreadState_modifies) apply (fastforce simp: guard_is_UNIV_def ThreadState_Inactive_def
                                        mask_def ThreadState_Running_def cap_get_tag_isCap
                                        ccap_relation_ep_helpers) apply (clarsimp simp: valid_tcb_state'_def) apply (rule_tac Q="\<lambda>_. valid_pspace' and valid_queues
                                       and st_tcb_at' ((=) sendState) sender and tcb_at' thread
                                       and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)
                                       and (\<lambda>s. (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))))
                                       and sch_act_not sender and K (thread \<noteq> sender)
                                       and (\<lambda>s. ksCurDomain s \<le> maxDomain)" in hoare_post_imp) apply (clarsimp simp: valid_pspace_valid_objs' pred_tcb_at'_def sch_act_wf_weak
                                      obj_at'_def) apply (wpsimp simp: guard_is_UNIV_def option_to_ptr_def option_to_0_def conj_ac)+ apply (rule_tac Q="\<lambda>rv. valid_queues and valid_pspace'
                               and cur_tcb' and tcb_at' sender and tcb_at' thread
                               and sch_act_not sender and K (thread \<noteq> sender)
                               and ep_at' (capEPPtr cap)
                               and (\<lambda>s. ksCurDomain s \<le> maxDomain)
                               and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and>
                                        (\<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))))"
                            in hoare_post_imp) subgoal by (auto, auto simp: st_tcb_at'_def obj_at'_def) apply (wp hoare_vcg_all_lift set_ep_valid_objs') apply (clarsimp simp: guard_is_UNIV_def) apply (clarsimp simp: EPState_Recv_def EPState_Send_def EPState_Idle_def) apply (frule(1) ko_at_valid_objs' [OF _ invs_valid_objs']) apply (clarsimp simp: projectKO_opt_ep split: kernel_object.split_asm) apply (subgoal_tac "(capEPPtr cap) \<noteq> thread
                       \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}") apply (clarsimp simp: valid_obj'_def valid_ep'_def refs_of'_def
                          split: endpoint.splits) apply (rename_tac list) apply (subgoal_tac "state_refs_of' s (capEPPtr cap) = (set list) \<times> {EPRecv}
                                 \<and> thread \<notin> (set list)") subgoal by (fastforce simp: obj_at'_def is_aligned_neg_mask objBits_simps'
                                          projectKOs invs'_def valid_state'_def st_tcb_at'_def
                                          valid_tcb_state'_def ko_wp_at'_def invs_valid_objs'
                                          isBlockedOnReceive_def projectKO_opt_tcb
                                   elim!: delta_sym_refs
                                   split: if_split_asm bool.splits)  (*very long*)
              apply (frule(1) sym_refs_obj_atD' [OF _ invs_sym']) apply (clarsimp simp: st_tcb_at'_def ko_wp_at'_def obj_at'_def projectKOs
                            split: if_split_asm) apply (drule(1) bspec)+ apply (case_tac "tcbState obj", simp_all add: tcb_bound_refs'_def)[1] apply (subgoal_tac "state_refs_of' s (capEPPtr cap) = {}") subgoal by (fastforce simp: obj_at'_def is_aligned_neg_mask objBits_simps'
                                         projectKOs invs'_def valid_state'_def st_tcb_at'_def
                                         valid_tcb_state'_def ko_wp_at'_def invs_valid_objs'
                                         isBlockedOnReceive_def projectKO_opt_tcb
                                  elim!: delta_sym_refs
                                  split: if_split_asm bool.splits)  (*very long *)
             apply (clarsimp simp: obj_at'_def state_refs_of'_def projectKOs) apply (frule(1) sym_refs_ko_atD' [OF _ invs_sym']) apply (frule invs_queues) apply clarsimp apply (rename_tac list x xa) apply (rule_tac P="x\<in>set list" in case_split) apply (clarsimp simp:st_tcb_at_refs_of_rev') apply (erule_tac x=x and P="\<lambda>x. st_tcb_at' P x s" for P in ballE) apply (drule_tac t=x in valid_queues_not_runnable'_not_ksQ) apply (clarsimp simp: st_tcb_at'_def obj_at'_def) apply (subgoal_tac "sch_act_not x s") prefer 2 apply (frule invs_sch_act_wf') apply (clarsimp simp:sch_act_wf_def) apply (clarsimp simp: st_tcb_at'_def obj_at'_def) apply (clarsimp simp: obj_at'_def st_tcb_at'_def
                                   projectKOs isBlockedOnSend_def
                             split: list.split | rule conjI)+ apply (clarsimp simp: state_refs_of'_def ) apply (case_tac "tcbState obj", clarsimp+)[1] apply (clarsimp simp: guard_is_UNIV_def)+ apply (wp getNotification_wp | wpc)+ apply (clarsimp simp add: guard_is_UNIV_def option_to_ptr_def option_to_0_def
                          split: if_split) apply (wp gbn_wp' | simp add: guard_is_UNIV_def)+ apply (auto simp:  isCap_simps valid_cap'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap and K (isEndpointCap cap)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>) hs (receiveIPC thread cap isBlocking) (Call receiveIPC_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap and (\<lambda>y. isEndpointCap cap)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>) hs (receiveIPC thread cap isBlocking) (Call receiveIPC_'proc) proof (prove)
goal (1 subgoal):
 1. isEndpointCap cap \<Longrightarrow> ccorres dc xfdc (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>) hs (receiveIPC thread cap isBlocking) (Call receiveIPC_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga capa threada. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4497 isBlockinga capa threada) (?Q'4497 isBlockinga capa threada) (SKIP # hs) (do ep <- getEndpoint (capEPPtr cap);
ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(threada\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,threada)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlockinga \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,threada);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,threada,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))))
 2. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4497 isBlockinga capa threada s \<and> s' \<in> ?Q'4497 isBlockinga capa threada proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4503 isBlockinga capa threada ep) (?P'4503 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(threada\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,threada)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlockinga \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,threada);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,threada,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))))
 2. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> ?P4503 isBlockinga capa threada ep s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> ?P'4503 isBlockinga capa threada ep} proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4503 isBlockinga capa threada ep) (?P'4503 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(threada\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,threada)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlockinga \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,threada);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,threada,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))))
 2. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> ?P4503 isBlockinga capa threada ep s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> ?P'4503 isBlockinga capa threada ep} proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4503 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?P'4503 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
(\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))))
 2. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> ?P4503 isBlockinga capa threada ep s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> ?P'4503 isBlockinga capa threada ep} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga capa threada ep s. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. True \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = capEPPtr cap\<rbrace>)
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))) (?y'4505 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4508 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?Q4505 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?y'4505 isBlockinga capa threada ep (capEPPtr cap))
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q4505 isBlockinga capa threada ep)
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P4508 isBlockinga capa threada ep and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>capa s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift capa) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift capa)\<rparr>) \<in> rf_sr \<and> capEPPtr_CL (cap_endpoint_cap_lift capa) = capEPPtr cap)}
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))) (?y'4505 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4508 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?Q4505 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?y'4505 isBlockinga capa threada ep (capEPPtr cap))
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q4505 isBlockinga capa threada ep)
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P4508 isBlockinga capa threada ep and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>capa s x v0 v1 v2 v3 v4 v5. \<lbrakk>ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) capa; (s, x) \<in> rf_sr; cap = capability.EndpointCap v0 v1 v2 v3 v4 v5\<rbrakk> \<Longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift capa) = v0
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))) (?y'4505 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4508 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?Q4505 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?y'4505 isBlockinga capa threada ep (capEPPtr cap))
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q4505 isBlockinga capa threada ep)
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P4508 isBlockinga capa threada ep and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>capa s x v0 v1 v2 v3 v4 v5. \<lbrakk>ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) capa; (s, x) \<in> rf_sr; cap = capability.EndpointCap v0 v1 v2 v3 v4 v5; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift capa) = v0
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))) (?y'4505 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4508 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?Q4505 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?y'4505 isBlockinga capa threada ep (capEPPtr cap))
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q4505 isBlockinga capa threada ep)
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P4508 isBlockinga capa threada ep and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>epptr :== ep_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))) (?y'4505 isBlockinga capa threada ep rv')
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4508 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?Q4505 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?y'4505 isBlockinga capa threada ep (capEPPtr cap))
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q4505 isBlockinga capa threada ep)
 4. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P4508 isBlockinga capa threada ep and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4508 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?Q4505 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>epptr :== ep_Ptr (capEPPtr cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>epptr)));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,\<acute>epptr,\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI))))
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q4505 isBlockinga capa threada ep)
 3. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P4508 isBlockinga capa threada ep and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4508 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?G'4813 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> ?G'4813 isBlockinga capa threada ep})
 3. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P4508 isBlockinga capa threada ep and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A5874 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?C'5872 isBlockinga capa threada ep) (SKIP # hs) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C'']));;
(\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)))
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> ?C'5872 isBlockinga capa threada ep \<inter> \<lbrace>True\<rbrace>})
 3. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?A5874 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?P5883 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?C'5872 isBlockinga capa threada ep) [] (getBoundNotification thread) (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])))
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> ?C'5872 isBlockinga capa threada ep \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P5883 isBlockinga capa threada ep and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?P5883 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) (?C'5872 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep) [] (threadGet tcbBoundNotification thread) (\<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])))
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> ?C'5872 isBlockinga capa threada ep \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (?P5883 isBlockinga capa threada ep and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga capa threada ep x. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' thread \<sigma> \<and> (no_0_obj' and valid_objs') \<sigma> \<and> (\<forall>tcb. ko_at' tcb thread \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbBoundNotification tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> ctcb_relation tcb tcb'))} \<acute>ntfnPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])) {s. (\<sigma>, s) \<in> rf_sr \<and> ntfnPtr_' s = option_to_ptr x \<and> x \<noteq> Some 0}
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga capa threada ep x \<sigma>. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' thread \<sigma> \<and> (no_0_obj' and valid_objs') \<sigma> \<and> (\<forall>tcb. ko_at' tcb thread \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbBoundNotification tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> ctcb_relation tcb tcb'))} \<subseteq> {s. (\<sigma>, ntfnPtr_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C'']))) s) \<in> rf_sr \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])) = option_to_ptr x \<and> x \<noteq> Some 0}
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa x \<sigma> xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; (\<sigma>, xa) \<in> rf_sr; tcb_at' thread \<sigma>; no_0_obj' \<sigma>; valid_objs' \<sigma>; \<forall>tcb. ko_at' tcb thread \<sigma> \<longrightarrow> x = tcbBoundNotification tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> ctcb_relation tcb tcb')\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])) = option_to_ptr x \<and> x \<noteq> Some 0
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa x \<sigma> xa ko. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; (\<sigma>, xa) \<in> rf_sr; no_0_obj' \<sigma>; valid_objs' \<sigma>; \<forall>tcb. ko_at' tcb thread \<sigma> \<longrightarrow> x = tcbBoundNotification tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr thread) = Some tcb' \<and> ctcb_relation tcb tcb'); ko_at' ko thread \<sigma>\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])) = option_to_ptr (tcbBoundNotification ko) \<and> tcbBoundNotification ko \<noteq> Some 0
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa \<sigma> xa ko tcb'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; (\<sigma>, xa) \<in> rf_sr; no_0_obj' \<sigma>; valid_objs' \<sigma>; ko_at' ko thread \<sigma>; cslift xa (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation ko tcb'\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbBoundNotification_C''])) = option_to_ptr (tcbBoundNotification ko) \<and> tcbBoundNotification ko \<noteq> Some 0
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa \<sigma> xa ko tcb'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; (\<sigma>, xa) \<in> rf_sr; no_0_obj' \<sigma>; valid_objs' \<sigma>; ko_at' ko thread \<sigma>; cslift xa (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; tcbFaultHandler ko = tcbFaultHandler_C tcb'; cthread_state_relation (tcbState ko) (tcbState_C tcb', tcbFault_C tcb'); tcbIPCBuffer ko = tcbIPCBuffer_C tcb'; carch_tcb_relation (tcbArch ko) (tcbArch_C tcb'); tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C tcb'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C tcb'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C tcb'; tcbTimeSlice ko = unat (tcbTimeSlice_C tcb'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')); option_to_ptr (Some 0) = tcbBoundNotification_C tcb'; tcbBoundNotification ko = Some 0\<rbrakk> \<Longrightarrow> False
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa \<sigma> xa ko tcb'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; (\<sigma>, xa) \<in> rf_sr; no_0_obj' \<sigma>; valid_objs' \<sigma>; cslift xa (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; tcbFaultHandler ko = tcbFaultHandler_C tcb'; cthread_state_relation (tcbState ko) (tcbState_C tcb', tcbFault_C tcb'); tcbIPCBuffer ko = tcbIPCBuffer_C tcb'; carch_tcb_relation (tcbArch ko) (tcbArch_C tcb'); tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C tcb'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C tcb'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C tcb'; tcbTimeSlice ko = unat (tcbTimeSlice_C tcb'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')); option_to_ptr (Some 0) = tcbBoundNotification_C tcb'; tcbBoundNotification ko = Some 0; valid_obj' (injectKOS ko) \<sigma>\<rbrakk> \<Longrightarrow> False
 2. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlockinga capa threada ep rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ntfnPtr_' rv' t t' (\<acute>ret__int :== (if \<acute>ntfnPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(\<acute>ntfnPtr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)) (?d'5877 isBlockinga capa threada ep rv')
 2. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (?d'5877 isBlockinga capa threada ep rv')
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga capa threada ep rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; rv' = option_to_ptr rv \<and> rv \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep rv) (?Q'5877 isBlockinga capa threada ep rv rv') (SKIP # hs) (do ntfn <- case rv of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. rv = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust rv) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__int :== (if rv' \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(rv');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(rv',tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI))
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr ntfnptr'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr' = option_to_ptr ntfnptr \<and> ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 isBlockinga capa threada ep ntfnptr) (?Q'5877 isBlockinga capa threada ep ntfnptr ntfnptr') (SKIP # hs) (do ntfn <- case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a;
if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__int :== (if ntfnptr' \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnptr');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(ntfnptr',tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF from_bool isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI))
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr) (?Q'5877 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr)) (SKIP # hs) (do ntfn <- case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI))
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5877 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr) (?Q'5877 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr)) (SKIP # hs) (do ntfn <- case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x;
if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>?Q5877 isBlockinga capa threada ep\<rbrace>
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?P6980 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr) (?Q'5877 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr)) [] (case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. ?P6980 isBlockinga capa threada ep a and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (?Q'5877 isBlockinga capa threada ep)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?R6995 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr) (?R''6998 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr)) [] (return (NTFN Structures_H.ntfn.IdleNtfn None)) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr x2. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>a. ?R6994 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr a x2) (?R''6996 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr) x2) [] (getNotification x2) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> ?R6995 isBlockinga capa threada ep a b) \<and> (\<forall>x. a = Some x \<longrightarrow> ?R6994 isBlockinga capa threada ep a b x)) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> ?R''6998 isBlockinga capa threada ep a b} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> ?R''6996 isBlockinga capa threada ep a b x}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = None\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return (NTFN Structures_H.ntfn.IdleNtfn None) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (ret__int_' s = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)}
 2. \<And>isBlockinga capa threada ep ntfnptr x2. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>a. ?R6994 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr a x2) (?R''6996 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr) x2) [] (getNotification x2) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> ?R6994 isBlockinga capa threada ep a b x)) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> ?R''6996 isBlockinga capa threada ep a b x}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr \<sigma>. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = None\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. ((if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c option_to_ptr ntfnptr \<and> (\<forall>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (NTFN Structures_H.ntfn.IdleNtfn None) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))), ret__int_' := if notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0\<rparr>) \<in> rf_sr \<and> ((if notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)))) \<and> (\<not> (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (NTFN Structures_H.ntfn.IdleNtfn None) \<sigma>). (\<sigma>', s\<lparr>ret__int_' := if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0\<rparr>) \<in> rf_sr \<and> ((if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0) = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)))}
 2. \<And>isBlockinga capa threada ep ntfnptr x2. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>a. ?R6994 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr a x2) (?R''6996 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr) x2) [] (getNotification x2) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> ?R6994 isBlockinga capa threada ep a b x)) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> ?R''6996 isBlockinga capa threada ep a b x}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr x2. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>a. ?R6994 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr a x2) (?R''6996 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr) x2) [] (getNotification x2) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> ?R6994 isBlockinga capa threada ep a b x)) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> ?R''6996 isBlockinga capa threada ep a b x}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr x2 rv. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>a. ?P7049 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr x2 a rv) (?P'7047 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr (option_to_ptr ntfnptr) x2 rv) [] (return rv) (\<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ?P7049 isBlockinga capa threada ep a x b ntfn))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> ?P'7047 isBlockinga capa threada ep a b x ntfn}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr x2 rv. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = Some x2\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. ko_at' rv (the ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__int :== (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(option_to_ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return rv \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (ret__int_' s = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)}
 2. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr x2 rv \<sigma>. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; ntfnptr = Some x2\<rbrakk> \<Longrightarrow> {s. ko_at' rv (the ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. ((if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c option_to_ptr ntfnptr \<and> (\<forall>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return rv \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))), ret__int_' := if notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0\<rparr>) \<in> rf_sr \<and> ((if notification_CL.state_CL (notification_lift (the (cslift s (option_to_ptr ntfnptr)))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)))) \<and> (\<not> (if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return rv \<sigma>). (\<sigma>', s\<lparr>ret__int_' := if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0\<rparr>) \<in> rf_sr \<and> ((if option_to_ptr ntfnptr \<noteq> NULL then 1 else 0) = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)))}
 2. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa x2 rv \<sigma> x. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; x2 \<noteq> 0; ko_at' rv x2 \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr x2 \<and> ((\<exists>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr x2))))) \<longrightarrow> (notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr x2)))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active) = EndpointDecls_H.isActive rv)
 2. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>capa x2 rv \<sigma> x. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; x2 \<noteq> 0; ko_at' rv x2 \<sigma>\<rbrakk> \<Longrightarrow> map_to_ntfns (ksPSpace \<sigma>) (?x7091 capa x2 rv \<sigma> x) = Some (?y7091 capa x2 rv \<sigma> x)
 2. \<And>capa x2 rv \<sigma> x y'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; x2 \<noteq> 0; ko_at' rv x2 \<sigma>; map_to_ntfns (ksPSpace \<sigma>) (?x7091 capa x2 rv \<sigma> x) = Some (?y7091 capa x2 rv \<sigma> x); cnotification_relation (cslift x) (?y7091 capa x2 rv \<sigma> x) y'; cslift x (ntfn_Ptr (?x7091 capa x2 rv \<sigma> x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr x2 \<and> ((\<exists>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr x2))))) \<longrightarrow> (notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr x2)))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active) = EndpointDecls_H.isActive rv)
 3. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa x2 rv \<sigma> x y'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; x2 \<noteq> 0; ko_at' rv x2 \<sigma>; map_to_ntfns (ksPSpace \<sigma>) x2 = Some rv; cnotification_relation (cslift x) rv y'; cslift x (ntfn_Ptr x2) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr x2 \<and> ((\<exists>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr x2))))) \<longrightarrow> (notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr x2)))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active) = EndpointDecls_H.isActive rv)
 2. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv' t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?d'6973 isBlockinga capa threada ep ntfnptr rv')
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6973 isBlockinga capa threada ep ntfnptr rv) (?Q'6973 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (if (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv then completeSignal (fromJust ntfnptr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF rv' \<noteq> 0 THEN
  CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread)
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>?Q6973 isBlockinga capa threada ep ntfnptr\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (?Q'6973 isBlockinga capa threada ep ntfnptr)
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) = (s' \<in> \<lbrace>rv' \<noteq> 0\<rbrace>)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8135 isBlockinga capa threada ep ntfnptr rv) (?Rt8133 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (completeSignal (fromJust ntfnptr) thread) (CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8137 isBlockinga capa threada ep ntfnptr rv) (?Rf8133 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> ?Pt8135 isBlockinga capa threada ep ntfnptr rv s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> ?Pf8137 isBlockinga capa threada ep ntfnptr rv s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. ?Rt8133 isBlockinga capa threada ep ntfnptr rv rv' \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> ?Rf8133 isBlockinga capa threada ep ntfnptr rv rv' \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8135 isBlockinga capa threada ep ntfnptr rv) (?Rt8133 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (completeSignal (fromJust ntfnptr) thread) (CALL completeSignal_'proc(option_to_ptr ntfnptr,tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8137 isBlockinga capa threada ep ntfnptr rv) (?Rf8133 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> ?Pt8135 isBlockinga capa threada ep ntfnptr rv s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> ?Pf8137 isBlockinga capa threada ep ntfnptr rv s)\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. ?Rt8133 isBlockinga capa threada ep ntfnptr rv rv' \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> ?Rf8133 isBlockinga capa threada ep ntfnptr rv rv' \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8137 isBlockinga capa threada ep ntfnptr rv) (?Rf8133 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> ?Pf8137 isBlockinga capa threada ep ntfnptr rv s)\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> ?Rf8133 isBlockinga capa threada ep ntfnptr rv rv' \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' s. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ep (capEPPtr cap) s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr cap)) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)\<rbrace>)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'a t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P8152 isBlockinga capa threada ep ntfnptr rv) (?Q8150 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rva rv'a. ?Q8150 isBlockinga capa threada ep ntfnptr rv rv')
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (?P8152 isBlockinga capa threada ep ntfnptr rv and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s x. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ko_at' ep (capEPPtr cap) s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr (capEPPtr cap) \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr (capEPPtr cap))))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'a t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P8152 isBlockinga capa threada ep ntfnptr rv) (?Q8150 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rva rv'a. ?Q8150 isBlockinga capa threada ep ntfnptr rv rv')
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (?P8152 isBlockinga capa threada ep ntfnptr rv and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s x. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ko_at' ep (capEPPtr cap) s\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace s) (?x8176 capa ep ntfnptr rv rv' s x) = Some (?y8176 capa ep ntfnptr rv rv' s x)
 2. \<And>capa ep ntfnptr rv rv' s x y'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ko_at' ep (capEPPtr cap) s; map_to_eps (ksPSpace s) (?x8176 capa ep ntfnptr rv rv' s x) = Some (?y8176 capa ep ntfnptr rv rv' s x); cendpoint_relation (cslift x) (?y8176 capa ep ntfnptr rv rv' s x) y'; cslift x (ep_Ptr (?x8176 capa ep ntfnptr rv rv' s x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr (capEPPtr cap) \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr (capEPPtr cap))))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'a t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P8152 isBlockinga capa threada ep ntfnptr rv) (?Q8150 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rva rv'a. ?Q8150 isBlockinga capa threada ep ntfnptr rv rv')
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (?P8152 isBlockinga capa threada ep ntfnptr rv and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s x y'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ko_at' ep (capEPPtr cap) s; map_to_eps (ksPSpace s) (capEPPtr cap) = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr (capEPPtr cap)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr (capEPPtr cap) \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr (capEPPtr cap))))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'a t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P8152 isBlockinga capa threada ep ntfnptr rv) (?Q8150 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rva rv'a. ?Q8150 isBlockinga capa threada ep ntfnptr rv rv')
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (?P8152 isBlockinga capa threada ep ntfnptr rv and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'a t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P8152 isBlockinga capa threada ep ntfnptr rv) (?Q8150 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'8150 isBlockinga capa threada ep ntfnptr rv rv' (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rva rv'a. ?Q8150 isBlockinga capa threada ep ntfnptr rv rv')
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (?P8152 isBlockinga capa threada ep ntfnptr rv and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P8152 isBlockinga capa threada ep ntfnptr rv) (?Q8150 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rva rv'a. ?Q8150 isBlockinga capa threada ep ntfnptr rv rv')
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (?P8152 isBlockinga capa threada ep ntfnptr rv and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8815 isBlockinga capa threada ep ntfnptr rv rv') (?Q'8815 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP a \<Rightarrow> case a of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q8815 isBlockinga capa threada ep ntfnptr rv rv' s \<and> s' \<in> ?Q'8815 isBlockinga capa threada ep ntfnptr rv rv'
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8827 isBlockinga capa threada ep ntfnptr rv rv' x1) (?R''8830 isBlockinga capa threada ep ntfnptr rv rv' x1) (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R8827 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''8830 isBlockinga capa threada ep ntfnptr rv rv' x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8827 isBlockinga capa threada ep ntfnptr rv rv' x1) (?R'8835 isBlockinga capa threada ep ntfnptr rv rv' x1) (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R8827 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R'8835 isBlockinga capa threada ep ntfnptr rv rv' x \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8827 isBlockinga capa threada ep ntfnptr rv rv' x1) (?G'8839 isBlockinga capa threada ep ntfnptr rv rv' x1) (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R8827 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8839 isBlockinga capa threada ep ntfnptr rv rv' x} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8827 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?G'8839 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R8827 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8839 isBlockinga capa threada ep ntfnptr rv rv' x} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8852 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?S8855 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> ?Q8852 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S8855 isBlockinga capa threada ep ntfnptr rv rv' x) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8852 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?S8855 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> ?Q8852 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S8855 isBlockinga capa threada ep ntfnptr rv rv' x) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8852 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?S8855 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> ?Q8852 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S8855 isBlockinga capa threada ep ntfnptr rv rv' x) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8852 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?S8855 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> ?Q8852 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S8855 isBlockinga capa threada ep ntfnptr rv rv' x) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8852 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?S8855 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> ?Q8852 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S8855 isBlockinga capa threada ep ntfnptr rv rv' x) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8852 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?S8855 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> ?Q8852 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S8855 isBlockinga capa threada ep ntfnptr rv rv' x) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres (?r'8899 isBlockinga capa threada ep ntfnptr rv rv' x1) (?xf'8899 isBlockinga capa threada ep ntfnptr rv rv' x1) (?P8905 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?S8855 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) [] (setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1 rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'8899 isBlockinga capa threada ep ntfnptr rv rv' x1) rv'a t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))) (?d'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1 rva rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking; ?r'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rva) (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rva rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))) (?d'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rv'a)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R8903 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'8899 isBlockinga capa threada ep ntfnptr rv rv' x1) (?xf'8899 isBlockinga capa threada ep ntfnptr rv rv' x1) (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (?P8905 isBlockinga capa threada ep ntfnptr rv rv' x and ?R8903 isBlockinga capa threada ep ntfnptr rv rv' x) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S8855 isBlockinga capa threada ep ntfnptr rv rv' x) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1 rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))) (?d'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1 rva rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rva) (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rva rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))) (?d'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R8903 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R8903 isBlockinga capa threada ep ntfnptr rv rv' x) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1 rva rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rva) (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1 rva rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R8903 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R8903 isBlockinga capa threada ep ntfnptr rv rv' x) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1 rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8899 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1 ()) (?Q'8899 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1 () rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (x1 @ [thread]))) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R8903 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R8903 isBlockinga capa threada ep ntfnptr rv rv' x) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' list NOo. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP list; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8899 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP list) ntfnptr rv rv' list ()) (?Q'8899 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP list) ntfnptr rv rv' list () NOo) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP (list @ [thread]))) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R8903 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q8899 isBlockinga capa threada ep ntfnptr rv rv' x1\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8899 isBlockinga capa threada ep ntfnptr rv rv' x1)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R8903 isBlockinga capa threada ep ntfnptr rv rv' x) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R8903 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>\<lambda>a. valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(capEPPtr cap := set (x1 @ [thread]) \<times> {EPRecv}))) and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = capEPPtr cap) thread and ko_at' ep (capEPPtr cap) and (\<lambda>y. ep = Structures_H.endpoint.IdleEP \<and> x1 @ [thread] = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> x1 @ [thread] = q @ [thread]))\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R8903 isBlockinga capa threada ep ntfnptr rv rv' x) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R8903 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>\<lambda>a b. valid_pspace' b \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set x1 \<times> {EPRecv}) else state_refs_of' b a) \<and> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = capEPPtr cap) thread b \<and> ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) b \<and> thread \<notin> set x1\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R8903 isBlockinga capa threada ep ntfnptr rv rv' x) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' list. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP list; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>a b. UNIV)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x1. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.RecvEP x1; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8851 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (?T8853 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.RecvEP x1) ntfnptr rv rv' x1) (SKIP # hs) (doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8851 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8853 isBlockinga capa threada ep ntfnptr rv rv' x)}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R''8831 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''8831 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?R'8981 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R'8981 isBlockinga capa threada ep ntfnptr rv rv' \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 isBlockinga capa threada ep ntfnptr rv rv') (?G'8985 isBlockinga capa threada ep ntfnptr rv rv') (SKIP # hs) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8985 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8828 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?G'8985 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8828 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8985 isBlockinga capa threada ep ntfnptr rv rv'} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8998 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?S9001 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> ?Q8998 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S9001 isBlockinga capa threada ep ntfnptr rv rv') \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8998 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?S9001 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> ?Q8998 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S9001 isBlockinga capa threada ep ntfnptr rv rv') \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8998 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?S9001 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> ?Q8998 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S9001 isBlockinga capa threada ep ntfnptr rv rv') \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8998 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?S9001 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> ?Q8998 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S9001 isBlockinga capa threada ep ntfnptr rv rv') \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8998 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?S9001 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> ?Q8998 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S9001 isBlockinga capa threada ep ntfnptr rv rv') \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8998 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?S9001 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> ?Q8998 isBlockinga capa threada ep ntfnptr rv rv' s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S9001 isBlockinga capa threada ep ntfnptr rv rv') \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres (?r'9045 isBlockinga capa threada ep ntfnptr rv rv') (?xf'9045 isBlockinga capa threada ep ntfnptr rv rv') (?P9051 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?S9001 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') [] (setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capEPPtr cap));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9045 isBlockinga capa threada ep ntfnptr rv rv') rv'a t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))) (?d'9045 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' rva rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking; ?r'9045 isBlockinga capa threada ep ntfnptr rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9045 isBlockinga capa threada ep ntfnptr rv rv' rva) (?Q'9045 isBlockinga capa threada ep ntfnptr rv rv' rva rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])) (?d'9045 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R9049 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q9045 isBlockinga capa threada ep ntfnptr rv rv'\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9045 isBlockinga capa threada ep ntfnptr rv rv') (?xf'9045 isBlockinga capa threada ep ntfnptr rv rv') (?Q'9045 isBlockinga capa threada ep ntfnptr rv rv')
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (?P9051 isBlockinga capa threada ep ntfnptr rv rv' and ?R9049 isBlockinga capa threada ep ntfnptr rv rv') s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S9001 isBlockinga capa threada ep ntfnptr rv rv') \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a t t'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap))))) (?d'9045 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' rva rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9045 isBlockinga capa threada ep ntfnptr rv rv' rva) (?Q'9045 isBlockinga capa threada ep ntfnptr rv rv' rva rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])) (?d'9045 isBlockinga capa threada ep ntfnptr rv rv' rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R9049 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q9045 isBlockinga capa threada ep ntfnptr rv rv'\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'9045 isBlockinga capa threada ep ntfnptr rv rv')
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R9049 isBlockinga capa threada ep ntfnptr rv rv') s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' rva rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9045 isBlockinga capa threada ep ntfnptr rv rv' rva) (?Q'9045 isBlockinga capa threada ep ntfnptr rv rv' rva rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R9049 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q9045 isBlockinga capa threada ep ntfnptr rv rv'\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'9045 isBlockinga capa threada ep ntfnptr rv rv')
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R9049 isBlockinga capa threada ep ntfnptr rv rv') s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' rv'a. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9045 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv' ()) (?Q'9045 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv' () rv'a) (SKIP # hs) (setEndpoint (capEPPtr cap) (Structures_H.endpoint.RecvEP [thread])) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R9049 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>?Q9045 isBlockinga capa threada ep ntfnptr rv rv'\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'9045 isBlockinga capa threada ep ntfnptr rv rv')
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R9049 isBlockinga capa threada ep ntfnptr rv rv') s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R9049 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>\<lambda>a. valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(capEPPtr cap := set [thread] \<times> {EPRecv}))) and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = capEPPtr cap) thread and ko_at' ep (capEPPtr cap) and (\<lambda>y. ep = ep \<and> [thread] = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> [thread] = q @ [thread]))\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R9049 isBlockinga capa threada ep ntfnptr rv rv') s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R9049 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread \<lbrace>\<lambda>a b. valid_pspace' b \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else state_refs_of' b a) \<and> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = capEPPtr cap) thread b \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) b\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and ?R9049 isBlockinga capa threada ep ntfnptr rv rv') s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isBlocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>a b. UNIV)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (if isBlocking then do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) thread;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [thread]
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8997 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (?T8999 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) Structures_H.endpoint.IdleEP ntfnptr rv rv') (SKIP # hs) (doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> ?R8997 isBlockinga capa threada ep ntfnptr rv rv' s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T8999 isBlockinga capa threada ep ntfnptr rv rv')}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  lvar_nondet_init queue_' queue_'_update;;
IF isBlocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr (capEPPtr cap)))));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''8832 isBlockinga capa threada ep ntfnptr rv rv' x}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R'9125 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R'9125 isBlockinga capa threada ep ntfnptr rv rv' x \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R'9127 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init sender_' sender_'_update;;
lvar_nondet_init badge_' badge_'_update;;
lvar_nondet_init canGrant_' canGrant_'_update;;
lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
lvar_nondet_init do_call_' do_call_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>badge :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrant :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R'9127 isBlockinga capa threada ep ntfnptr rv rv' x \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R'9127 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (lvar_nondet_init queue_' queue_'_update;;
(lvar_nondet_init sender_' sender_'_update;;
(lvar_nondet_init badge_' badge_'_update;;
(lvar_nondet_init canGrant_' canGrant_'_update;;
(lvar_nondet_init canGrantReply_' canGrantReply_'_update;;
(lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI))))))))))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R'9127 isBlockinga capa threada ep ntfnptr rv rv' x \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R8829 isBlockinga capa threada ep ntfnptr rv rv' x3) (?G'9194 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8829 isBlockinga capa threada ep ntfnptr rv rv' x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> ?G'9194 isBlockinga capa threada ep ntfnptr rv rv' x}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = []\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9212 isBlockinga capa threada ep ntfnptr rv rv' x3) (?R''9214 isBlockinga capa threada ep ntfnptr rv rv' x3) (SKIP # hs) (haskell_fail []) (lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22) (?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case x22 of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP x22;
senderState <- getThreadState x21;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer x21 (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap x21 thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive x21 | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running x21;
possibleSwitchTo x21
od
od) (lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> ?R9212 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> ?R''9214 isBlockinga capa threada ep ntfnptr rv rv' x} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP []; x3 = []\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9212 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP []) ntfnptr rv rv' []) (?R''9214 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP []) ntfnptr rv rv' []) (SKIP # hs) fail (lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22) (?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case x22 of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP x22;
senderState <- getThreadState x21;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer x21 (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap x21 thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive x21 | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running x21;
possibleSwitchTo x21
od
od) (lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> ?R9212 isBlockinga capa threada ep ntfnptr rv rv' x s) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> ?R''9214 isBlockinga capa threada ep ntfnptr rv rv' x} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22) (?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x3 x21 x22) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case x22 of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP x22;
senderState <- getThreadState x21;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer x21 (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap x21 thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive x21 | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running x21;
possibleSwitchTo x21
od
od) (lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (lvar_nondet_init do_call_' do_call_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''9215 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
(\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI))))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> ?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> ?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI))))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> ?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI)))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> ?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R9213 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (SKIP # hs) (do setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI))))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R9213 isBlockinga capa threada ep ntfnptr rv rv' x xa xb s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> ?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres (?r'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?xf'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?P9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) [] (setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap),\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI))))))))) (?d'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest; ?r'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva) (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a) (SKIP # hs) (K_bind (do senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) rva) (?d'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?xf'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (?P9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> ?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest\<rbrakk> \<Longrightarrow> ccorres (?r'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?xf'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?P9237 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest) (?G'9220 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest) [] (setEndpoint (capEPPtr cap) (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr (capEPPtr cap));;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender);;
CALL ep_ptr_set_queue_'proc(ep_Ptr (capEPPtr cap));;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr (capEPPtr cap),SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI))))))))) (?d'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest; ?r'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva) (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a) (SKIP # hs) (K_bind (do senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) rva) (?d'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?xf'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest) (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (?P9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> ?G'9220 isBlockinga capa threada ep ntfnptr rv rv' x xa xb}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> sender_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(\<acute>sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(\<acute>sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(\<acute>sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(\<acute>sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>sender)
FI))))))))) (?d'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest; rv'a = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva) (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a) (SKIP # hs) (K_bind (do senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) rva) (?d'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest; rv'a = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva) (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva rv'a) (SKIP # hs) (K_bind (do senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) rva) (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(rv'a\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(rv'a\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(rv'a\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(rv'a,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(rv'a\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(rv'a,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(rv'a,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(rv'a,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(rv'a)
FI)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva) (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender') (SKIP # hs) (K_bind (do senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) rva) (Guard C_Guard {s. s \<Turnstile>\<^sub>c sender'} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(sender'\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender'} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(sender'\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender'} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(sender'\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(sender',ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c sender'} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(sender'\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(sender',tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(sender',SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(sender',SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(sender')
FI)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9237 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva) (?Q'9237 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva (tcb_ptr_to_ctcb_ptr sender)) (SKIP # hs) (do senderState <- getThreadState sender;
y <- assert (isSend senderState);
y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case (blockingIPCIsCall senderState, blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>?Q9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (?Q'9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A9615 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva) (?C'9612 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva (tcb_ptr_to_ctcb_ptr sender)) (SKIP # hs) (do senderState <- getThreadState sender;
y <- assert (isSend senderState);
y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case (blockingIPCIsCall senderState, blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. ?A9615 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. ?C'9612 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a b \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' rvb. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P9620 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva a rvb) (?P'9621 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva (tcb_ptr_to_ctcb_ptr sender) rvb) (SKIP # hs) (do y <- assert (isSend rvb);
y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge rvb) (blockingIPCCanGrant rvb) thread;
case (blockingIPCIsCall rvb, blockingIPCCanGrant rvb \<or> blockingIPCCanGrantReply rvb) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> ?P9620 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a aa ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'9621 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a b ts} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P9620 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva a sendState) (?P'9621 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva (tcb_ptr_to_ctcb_ptr sender) sendState) (SKIP # hs) (do y <- assert (isSend sendState);
y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> ?P9620 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a aa ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'9621 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a b ts} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9627 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva sendState) (?P'9621 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva (tcb_ptr_to_ctcb_ptr sender) sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
(\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> ?P9627 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'9621 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a b ts} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9627 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva sendState) (?P'9621 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva (tcb_ptr_to_ctcb_ptr sender) sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
\<acute>badge :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> ?P9627 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'9621 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a b ts} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (\<exists>t. ko_at' t sender s \<and> tcbState t = sendState) \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
\<acute>badge :== \<acute>ret__unsigned ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace>)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))))) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9637 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva sendState) (?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState (blockingIPCBadge sendState))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P9637 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>capa ntfnptr rv rv' sender s x t. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend (tcbState t); (s, x) \<in> rf_sr; ko_at' t sender s\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift x (tcb_ptr_to_ctcb_ptr sender))))) = blockingIPCBadge (tcbState t)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))))) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9637 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva sendState) (?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState (blockingIPCBadge sendState))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P9637 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>capa ntfnptr rv rv' sender s x t ko'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend (tcbState t); ko_at' t sender s; cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko'; ctcb_relation t ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift x (tcb_ptr_to_ctcb_ptr sender))))) = blockingIPCBadge (tcbState t)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))))) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9637 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva sendState) (?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState (blockingIPCBadge sendState))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P9637 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),\<acute>badge,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))))) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9637 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva sendState) (?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState (blockingIPCBadge sendState))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P9637 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9637 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest rva sendState) (?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Just (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case (blockingIPCIsCall sendState, blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P9637 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P9637 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q9634 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () (tcb_ptr_to_ctcb_ptr sender) sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?Q9634 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P9637 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A10107 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?C'10104 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () (tcb_ptr_to_ctcb_ptr sender) sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
(\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?C'10104 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState \<inter> \<lbrace>True\<rbrace>)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?A10107 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A10107 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?C'10104 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () (tcb_ptr_to_ctcb_ptr sender) sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
\<acute>canGrant :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rvb rv'a. ?C'10104 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState \<inter> \<lbrace>True\<rbrace>)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?A10107 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (\<exists>t. ko_at' t sender s \<and> tcbState t = sendState) \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
\<acute>canGrant :== \<acute>ret__unsigned ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>canGrant = from_bool (blockingIPCCanGrant sendState)\<rbrace>)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> canGrant_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10117 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState (from_bool (blockingIPCCanGrant sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rva rv'a. ?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10117 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>capa ntfnptr rv rv' sender s x t. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend (tcbState t); (s, x) \<in> rf_sr; ko_at' t sender s\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift x (tcb_ptr_to_ctcb_ptr sender))))) = from_bool (blockingIPCCanGrant (tcbState t))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> canGrant_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10117 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState (from_bool (blockingIPCCanGrant sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rva rv'a. ?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10117 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>capa ntfnptr rv rv' sender s x t ko'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend (tcbState t); ko_at' t sender s; cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko'; ctcb_relation t ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift x (tcb_ptr_to_ctcb_ptr sender))))) = from_bool (blockingIPCCanGrant (tcbState t))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> canGrant_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10117 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState (from_bool (blockingIPCCanGrant sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rva rv'a. ?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10117 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> canGrant_' rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,\<acute>canGrant,tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF \<acute>canGrant = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10117 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState (from_bool (blockingIPCCanGrant sendState)))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rva rv'a. ?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10117 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10117 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,from_bool (blockingIPCCanGrant sendState),tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rva rv'a. ?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10117 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10117 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,from_bool (blockingIPCCanGrant sendState),tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rva rv'a. ?Q10114 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10117 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. st_tcb_at' ((=) sendState) sender s \<and> (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
\<acute>canGrantReply :== \<acute>ret__unsigned ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>canGrantReply = from_bool (blockingIPCCanGrantReply sendState)\<rbrace>)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> canGrantReply_' rv'a t t' (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,from_bool (blockingIPCCanGrant sendState),tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))) (?y'10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10549 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState (from_bool (blockingIPCCanGrantReply sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rva rv'a. ?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10549 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>capa ntfnptr rv rv' sender sendState s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState\<rbrakk> \<Longrightarrow> {s'. st_tcb_at' ((=) sendState) sender s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingIPCCanGrantReply_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (s, canGrantReply_'_update (\<lambda>_. blockingIPCCanGrantReply_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))) (sa\<lparr>ret__unsigned_' := blockingIPCCanGrantReply_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))\<rparr>)) \<in> rf_sr \<and> blockingIPCCanGrantReply_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = from_bool (blockingIPCCanGrantReply sendState))}
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> canGrantReply_' rv'a t t' (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,from_bool (blockingIPCCanGrant sendState),tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))) (?y'10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10549 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState (from_bool (blockingIPCCanGrantReply sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rva rv'a. ?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10549 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ceqv \<Gamma> canGrantReply_' rv'a t t' (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,from_bool (blockingIPCCanGrant sendState),tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> \<acute>canGrantReply \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))) (?y'10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10549 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (?y'10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState (from_bool (blockingIPCCanGrantReply sendState)))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rva rv'a. ?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10549 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10549 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState) (?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState) (SKIP # hs) (do y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread;
case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od) (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,ep_Ptr (capEPPtr cap),blockingIPCBadge sendState,from_bool (blockingIPCCanGrant sendState),tcb_ptr_to_ctcb_ptr thread);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rva rv'a. ?Q10546 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (?P10549 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q10901 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?Q'10901 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C''])));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>?Q10901 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rva rv'a. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'10901 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva (xfdc t)})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A10938 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?C'10937 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
(\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?A10938 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rva rv'a. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'10937 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva (xfdc t) \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A10938 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?C'10937 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
\<acute>do_call :== \<acute>ret__unsigned;;
IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?A10938 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rva rv'a. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'10937 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva (xfdc t) \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (\<exists>t. ko_at' t sender s \<and> tcbState t = sendState) \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbState_C'']));;
\<acute>do_call :== \<acute>ret__unsigned ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>do_call = from_bool (blockingIPCIsCall sendState)\<rbrace>)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> do_call_' rv'a t t' (IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca (from_bool (blockingIPCIsCall sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. ?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>capa ntfnptr rv rv' sender s x t. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend (tcbState t); (s, x) \<in> rf_sr; ko_at' t sender s\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> blockingIPCIsCall_CL (thread_state_lift (tcbState_C (the (cslift x (tcb_ptr_to_ctcb_ptr sender))))) = from_bool (blockingIPCIsCall (tcbState t))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> do_call_' rv'a t t' (IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca (from_bool (blockingIPCIsCall sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. ?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>capa ntfnptr rv rv' sender s x t ko'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend (tcbState t); ko_at' t sender s; cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko'; ctcb_relation t ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> blockingIPCIsCall_CL (thread_state_lift (tcbState_C (the (cslift x (tcb_ptr_to_ctcb_ptr sender))))) = from_bool (blockingIPCIsCall (tcbState t))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> do_call_' rv'a t t' (IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca (from_bool (blockingIPCIsCall sendState)))
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. ?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a t t'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> do_call_' rv'a t t' (IF \<acute>do_call \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc rv'a)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (?y'10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca (from_bool (blockingIPCIsCall sendState)))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. ?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva) (?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF from_bool (blockingIPCIsCall sendState) \<noteq> 0 THEN
  IF from_bool (blockingIPCCanGrant sendState) = 0 \<longrightarrow> from_bool (blockingIPCCanGrantReply sendState) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. ?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10945 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?Q10943 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (case blockingIPCIsCall sendState of True \<Rightarrow> case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. ?Q10943 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. ?P10945 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11260 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11262 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> ?R''11262 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ?R11260 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11260 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11262 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> ?R''11262 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ?R11260 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11260 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11262 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (IF True THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> ?R''11262 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ?R11260 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11260 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11262 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (case blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> ?R''11262 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ?R11260 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState; blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11354 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11356 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (setupCallerCap sender thread (capEPCanGrant cap)) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned))
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState; \<not> blockingIPCCanGrant sendState; \<not> blockingIPCCanGrantReply sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11353 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11355 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive sender) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 3. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> ?R''11356 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> ?R''11355 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> ?R11354 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> ?R11353 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca ret__unsigned. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState; blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState; ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11354 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?G'11450 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca ret__unsigned) (SKIP # hs) (setupCallerCap sender thread (capEPCanGrant cap)) (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,ret__unsigned))
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState; \<not> blockingIPCCanGrant sendState; \<not> blockingIPCCanGrantReply sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11353 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11355 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive sender) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 3. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'11450 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> ?R''11355 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> ?R11354 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> ?R11353 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState; blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11354 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?G'11450 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca (capCanGrant_CL (cap_endpoint_cap_lift capa))) (SKIP # hs) (setupCallerCap sender thread (capEPCanGrant cap)) (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,capCanGrant_CL (cap_endpoint_cap_lift capa)))
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState; \<not> blockingIPCCanGrant sendState; \<not> blockingIPCCanGrantReply sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11353 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11355 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive sender) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 3. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'11450 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> ?R''11355 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> ?R11354 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> ?R11353 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState; \<not> blockingIPCCanGrant sendState; \<not> blockingIPCCanGrantReply sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11353 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11355 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive sender) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> ?R''11355 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> ?R11353 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; blockingIPCIsCall sendState = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF blockingIPCIsCall sendState THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (IF False THEN
  IF blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr thread,\<acute>ret__unsigned)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender)
FI)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11259 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()) (?R''11261 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> ?R''11261 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ?R11259 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca rva xfdcb. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState; dc rva xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11568 isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca rva) (?Q'11568 isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca rva xfdcb) (SKIP # hs) (possibleSwitchTo sender) (CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr sender))
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R11574 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()\<rbrace> setThreadState Structures_H.thread_state.Running sender \<lbrace>?Q11568 isBlockinga capa ntfnptr rv rv' sender rest sendState xfdc\<rbrace>
 3. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11569 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'11568 isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca rva (xfdc s)}
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>} \<inter> ?R'11569 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ((\<lambda>a. tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R11574 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a) b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R11574 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState ()\<rbrace> setThreadState Structures_H.thread_state.Running sender \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' sender and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs'\<rbrace>
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11569 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> UNIV}}
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>} \<inter> ?R'11569 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>b. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) b) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ((\<lambda>a. tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R11574 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState a) b)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState xfdca. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; \<not> blockingIPCIsCall sendState\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11569 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest (tcb_ptr_to_ctcb_ptr sender) sendState () xfdca) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> UNIV}}
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rvb rv'a. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>} \<inter> ?R'11569 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>a. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) a) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Inactive a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction a) a)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ((\<lambda>a. tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues a \<and> ((\<exists>p. sender \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (if sender = sender then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' sender) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a)) a)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 10. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState rva xfdc. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCIsCall sendState)) do_call_' (\<lambda>rv rv'. {s. blockingIPCIsCall sendState = True \<longrightarrow> s \<in> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. canGrant_'_update (\<lambda>_. v) (receiver_'_update (\<lambda>_. threada) (sender_'_update (\<lambda>_. sender') s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sender'\<rbrace> \<inter> \<lbrace>\<acute>receiver = threada\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cap)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}} \<inter> {s. (blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>}}} \<inter> {s. blockingIPCIsCall sendState = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. sender') s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = sender'\<rbrace>} \<inter> \<lbrace>True\<rbrace>})
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>a. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) a) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Inactive a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction a) a)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ((\<lambda>a. tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues a \<and> ((\<exists>p. sender \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (if sender = sender then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' sender) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a)) a)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a. (\<lambda>a. (blockingIPCIsCall sendState = True \<longrightarrow> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not sender and tcb_at' sender and tcb_at' thread and tcb_at' sender and tcb_at' thread) a) \<and> ((blockingIPCCanGrant sendState \<or> blockingIPCCanGrantReply sendState) = False \<longrightarrow> tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Inactive a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction a) a)) \<and> (blockingIPCIsCall sendState = False \<longrightarrow> ((\<lambda>a. tcb_at' sender a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. sender \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues a \<and> ((\<exists>p. sender \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread sender \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (if sender = sender then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' sender) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a)) a)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = sendState) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>a b. (blockingIPCIsCall sendState \<longrightarrow> (blockingIPCCanGrant sendState \<longrightarrow> Invariants_H.valid_queues b \<and> valid_pspace' b \<and> (\<forall>d p. sender \<notin> set (ksReadyQueues b (d, p))) \<and> sch_act_wf (ksSchedulerAction b) b \<and> sch_act_not sender b \<and> tcb_at' sender b \<and> tcb_at' thread b \<and> tcb_at' sender b \<and> tcb_at' thread b) \<and> (blockingIPCCanGrantReply sendState \<longrightarrow> Invariants_H.valid_queues b \<and> valid_pspace' b \<and> (\<forall>d p. sender \<notin> set (ksReadyQueues b (d, p))) \<and> sch_act_wf (ksSchedulerAction b) b \<and> sch_act_not sender b \<and> tcb_at' sender b \<and> tcb_at' thread b \<and> tcb_at' sender b \<and> tcb_at' thread b) \<and> (\<not> blockingIPCCanGrant sendState \<and> \<not> blockingIPCCanGrantReply sendState \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_not sender b \<and> (\<forall>a ba. sender \<notin> set (ksReadyQueues b (a, ba))) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (\<not> blockingIPCIsCall sendState \<longrightarrow> tcb_at' sender b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> Invariants_H.valid_queues b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> ksCurDomain b \<le> maxDomain \<and> valid_objs' b) \<and> (\<exists>t. ko_at' t sender b \<and> tcbState t = sendState) \<and> tcb_at' sender b\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState rva s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState; (valid_pspace' and Invariants_H.valid_queues and st_tcb_at' ((=) sendState) sender and tcb_at' thread and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and (\<lambda>s. \<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) and sch_act_not sender and K (thread \<noteq> sender) and (\<lambda>s. ksCurDomain s \<le> maxDomain)) s\<rbrakk> \<Longrightarrow> (blockingIPCIsCall sendState \<longrightarrow> (blockingIPCCanGrant sendState \<longrightarrow> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> (\<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not sender s \<and> tcb_at' sender s \<and> tcb_at' thread s \<and> tcb_at' sender s \<and> tcb_at' thread s) \<and> (blockingIPCCanGrantReply sendState \<longrightarrow> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> (\<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))) \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not sender s \<and> tcb_at' sender s \<and> tcb_at' thread s \<and> tcb_at' sender s \<and> tcb_at' thread s) \<and> (\<not> blockingIPCCanGrant sendState \<and> \<not> blockingIPCCanGrantReply sendState \<longrightarrow> tcb_at' sender s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_wf (ksSchedulerAction s) s)) \<and> (\<not> blockingIPCIsCall sendState \<longrightarrow> tcb_at' sender s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s) \<and> (\<exists>t. ko_at' t sender s \<and> tcbState t = sendState) \<and> tcb_at' sender s
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>_. valid_pspace' and Invariants_H.valid_queues and st_tcb_at' ((=) sendState) sender and tcb_at' thread and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and (\<lambda>s. \<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) and sch_act_not sender and K (thread \<noteq> sender) and (\<lambda>s. ksCurDomain s \<le> maxDomain)\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 9. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); isSend sendState\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest () sendState\<rbrace> doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge sendState) (blockingIPCCanGrant sendState) thread \<lbrace>\<lambda>_. valid_pspace' and Invariants_H.valid_queues and st_tcb_at' ((=) sendState) sender and tcb_at' thread and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and (\<lambda>s. \<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) and sch_act_not sender and K (thread \<noteq> sender) and (\<lambda>s. ksCurDomain s \<le> maxDomain)\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrantReply sendState)) canGrantReply_' (\<lambda>rv rv'. {s. receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (grant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant sendState)) (badge_'_update (\<lambda>_. blockingIPCBadge sendState) (endpoint_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>blockingIPCCanGrant sendState = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = blockingIPCBadge sendState\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Some (capEPPtr cap))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (blockingIPCCanGrant sendState)) canGrant_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest rva sender' sendState. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP (sender # rest); x3 = sender # rest; sender' = tcb_ptr_to_ctcb_ptr sender; isSend sendState\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = blockingIPCBadge sendState) badge_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R9237 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest\<rbrace> setEndpoint (capEPPtr cap) $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) sender aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and K (thread \<noteq> sender \<and> Some (capEPPtr cap) \<noteq> Some 0) and ?R10904 isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest a ts and st_tcb_at' ((=) ts) sender and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) and (\<lambda>s. \<exists>t. ko_at' t sender s \<and> tcbState t = ts)) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and ?R9237 isBlockinga capa threada ep ntfnptr rv rv' x xa xb) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 10. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
A total of 14 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P'11782 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest\<rbrace> setEndpoint (capEPPtr cap) (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<lbrace>\<lambda>rv s. \<forall>ts. st_tcb_at' ((=) ts) sender s \<longrightarrow> cur_tcb' s \<and> valid_pspace' s \<and> Invariants_H.valid_queues s \<and> thread \<noteq> sender \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> capEPPtr cap \<noteq> 0 \<and> tcb_at' sender s \<and> tcb_at' thread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> (\<exists>t. tcbState t = ts \<and> ko_at' t sender s)\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and (\<lambda>a. tcb_at' xa a \<and> ?P'11782 isBlockinga capa threada ep ntfnptr rv rv' x xa xb a)) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest rva s. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (Invariants_H.valid_queues and valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and sch_act_not sender and K (thread \<noteq> sender) and ep_at' (capEPPtr cap) and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))))) s\<rbrakk> \<Longrightarrow> \<forall>ts. st_tcb_at' ((=) ts) sender s \<longrightarrow> cur_tcb' s \<and> valid_pspace' s \<and> Invariants_H.valid_queues s \<and> thread \<noteq> sender \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> capEPPtr cap \<noteq> 0 \<and> tcb_at' sender s \<and> tcb_at' thread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> (\<exists>t. tcbState t = ts \<and> ko_at' t sender s)
 2. \<And>isBlockinga capa ntfnptr rv rv' sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P'11782 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest\<rbrace> setEndpoint (capEPPtr cap) (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<lbrace>\<lambda>rv. Invariants_H.valid_queues and valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and sch_act_not sender and K (thread \<noteq> sender) and ep_at' (capEPPtr cap) and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))))\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and (\<lambda>a. tcb_at' xa a \<and> ?P'11782 isBlockinga capa threada ep ntfnptr rv rv' x xa xb a)) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isEndpointCap cap; ccap_relation cap capa_; ntfnptr_ \<noteq> Some 0; (rv'_ = 0) = (ntfnptr_ = None \<or> \<not> EndpointDecls_H.isActive rv_); (Invariants_H.valid_queues and valid_pspace' and cur_tcb' and tcb_at' sender_ and tcb_at' thread and sch_act_not sender_ and K (thread \<noteq> sender_) and ep_at' (capEPPtr cap) and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. sender_ \<notin> set (ksReadyQueues s (d, p))))) s_\<rbrakk> \<Longrightarrow> \<forall>ts. st_tcb_at' ((=) ts) sender_ s_ \<longrightarrow> cur_tcb' s_ \<and> valid_pspace' s_ \<and> Invariants_H.valid_queues s_ \<and> thread \<noteq> sender_ \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> ksCurDomain s_ \<le> maxDomain \<and> capEPPtr cap \<noteq> 0 \<and> tcb_at' sender_ s_ \<and> tcb_at' thread s_ \<and> sch_act_not sender_ s_ \<and> (\<forall>a b. sender_ \<notin> set (ksReadyQueues s_ (a, b))) \<and> (\<exists>t. tcbState t = ts \<and> ko_at' t sender_ s_) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga capa ntfnptr rv rv' sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P'11782 isBlockinga capa (tcb_ptr_to_ctcb_ptr thread) (Structures_H.endpoint.SendEP (sender # rest)) ntfnptr rv rv' (sender # rest) sender rest\<rbrace> setEndpoint (capEPPtr cap) (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<lbrace>\<lambda>rv. Invariants_H.valid_queues and valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' thread and sch_act_not sender and K (thread \<noteq> sender) and ep_at' (capEPPtr cap) and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))))\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and (\<lambda>a. tcb_at' xa a \<and> ?P'11782 isBlockinga capa threada ep ntfnptr rv rv' x xa xb a)) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' x3 sender rest. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); ep = Structures_H.endpoint.SendEP x3; x3 = sender # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and (\<lambda>a. tcb_at' xa a \<and> Invariants_H.valid_queues a \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xb)) a \<and> cur_tcb' a \<and> tcb_at' xa a \<and> tcb_at' thread a \<and> sch_act_not xa a \<and> K (thread \<noteq> xa) a \<and> ep_at' (capEPPtr cap) a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a \<and> (\<forall>x xb. xa \<notin> set (ksReadyQueues a (x, xb))))) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' ep (capEPPtr cap) a \<and> thread \<notin> set x)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (isBlocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' (capEPPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capEPPtr cap = capEPPtr cap && ~~ mask 4) and (\<lambda>y. isEndpointCap cap \<and> ccap_relation cap capa) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) a \<and> sym_refs (\<lambda>aa. if aa = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> blockingObject (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) = capEPPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnReceive a \<and> blockingObject a = capEPPtr cap) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) a)) s) \<and> (\<not> isBlocking \<longrightarrow> True)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa and ko_at' ep (capEPPtr cap) and (\<lambda>a. tcb_at' xa a \<and> Invariants_H.valid_queues a \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xb)) a \<and> cur_tcb' a \<and> tcb_at' xa a \<and> tcb_at' thread a \<and> sch_act_not xa a \<and> K (thread \<noteq> xa) a \<and> ep_at' (capEPPtr cap) a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a \<and> (\<forall>x xb. xa \<notin> set (ksReadyQueues a (x, xb))))) s))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. (isBlocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> isBlocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. sender_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. badge_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrant_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. canGrantReply_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. do_call_'_update (\<lambda>_. v) s \<in> UNIV}}}}}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' (Structures_H.endpoint.RecvEP x) (capEPPtr cap) s \<and> thread \<notin> set x) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa s \<and> ko_at' (Structures_H.endpoint.SendEP (xa # xb)) (capEPPtr cap) s \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xb) s \<and> cur_tcb' s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> sch_act_not xa s \<and> thread \<noteq> xa \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x xb. xa \<notin> set (ksReadyQueues s (x, xb)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s s' ko. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; projectKO_opt ko = Some ep\<rbrakk> \<Longrightarrow> injectKOS ep = ko
 2. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' (Structures_H.endpoint.RecvEP x) (capEPPtr cap) s \<and> thread \<notin> set x) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa s \<and> ko_at' (Structures_H.endpoint.SendEP (xa # xb)) (capEPPtr cap) s \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xb) s \<and> cur_tcb' s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> sch_act_not xa s \<and> thread \<noteq> xa \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x xb. xa \<notin> set (ksReadyQueues s (x, xb)))))
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' (Structures_H.endpoint.RecvEP x) (capEPPtr cap) s \<and> thread \<notin> set x) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa s \<and> ko_at' (Structures_H.endpoint.SendEP (xa # xb)) (capEPPtr cap) s \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xb) s \<and> cur_tcb' s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> sch_act_not xa s \<and> thread \<noteq> xa \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x xb. xa \<notin> set (ksReadyQueues s (x, xb)))))
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s; capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set x \<times> {EPRecv}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' (Structures_H.endpoint.RecvEP x) (capEPPtr cap) s \<and> thread \<notin> set x) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> isBlocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) xa s \<and> ko_at' (Structures_H.endpoint.SendEP (xa # xb)) (capEPPtr cap) s \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xb) s \<and> cur_tcb' s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> sch_act_not xa s \<and> thread \<noteq> xa \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x xb. xa \<notin> set (ksReadyQueues s (x, xb)))))
 2. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' x1. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x1 \<noteq> []; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set x1 \<times> {EPRecv}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> thread \<notin> set x1
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.RecvEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set list \<times> {EPRecv}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> thread \<notin> set list
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.RecvEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; isBlocking; state_refs_of' s (capEPPtr cap) = set list \<times> {EPRecv} \<and> thread \<notin> set list\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set list \<times> {EPRecv}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> thread \<notin> set list
 2. \<And>capa ntfnptr rv rv' s s' list. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.RecvEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; isBlocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capEPPtr cap) = set list \<times> {EPRecv} \<and> thread \<notin> set list
 3. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 4. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 5. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isEndpointCap cap; ccap_relation cap capa_; ntfnptr_ \<noteq> Some 0; (rv'_ = 0) = (ntfnptr_ = None \<or> \<not> EndpointDecls_H.isActive rv_); (s_, s'_) \<in> rf_sr; invs' s_; st_tcb_at' simple' thread s_; sch_act_not thread s_; \<forall>d p. thread \<notin> set (ksReadyQueues s_ (d, p)); ko_at' (Structures_H.endpoint.RecvEP list_) (capEPPtr cap) s_; capEPPtr cap \<noteq> thread; state_refs_of' s_ thread = {r \<in> state_refs_of' s_ thread. snd r = TCBBound}; list_ \<noteq> []; \<forall>t\<in>set list_. tcb_at' t s_; distinct list_; isBlocking; state_refs_of' s_ (capEPPtr cap) = set list_ \<times> {EPRecv} \<and> thread \<notin> set list_\<rbrakk> \<Longrightarrow> tcb_at' thread s_ \<and> Invariants_H.valid_queues s_ \<and> valid_objs' s_ \<and> ep_at' (capEPPtr cap) s_ \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s_ \<and> tcb_at' thread s_ \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s_ \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (thread, EPRecv) (set list_ \<times> {EPRecv}) else ((state_refs_of' s_)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s_ thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<and> thread \<notin> set list_ proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.RecvEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; isBlocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capEPPtr cap) = set list \<times> {EPRecv} \<and> thread \<notin> set list
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.RecvEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; isBlocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capEPPtr cap) = set list \<times> {EPRecv} \<and> thread \<notin> set list
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.RecvEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; isBlocking; \<exists>obj. obj = Structures_H.endpoint.RecvEP list \<and> state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS obj) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS obj). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> state_refs_of' s (capEPPtr cap) = set list \<times> {EPRecv} \<and> thread \<notin> set list
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list obj. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (objBitsKO ko) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (objBitsKO ko) s; distinct list; isBlocking; ksPSpace s (capEPPtr cap) = Some (KOEndpoint (Structures_H.endpoint.RecvEP list)); state_refs_of' s (capEPPtr cap) = set list \<times> {EPRecv}; \<forall>x\<in>set list. \<exists>ko. ksPSpace s x = Some ko \<and> is_aligned x (objBitsKO ko) \<and> (capEPPtr cap, TCBBlockedRecv) \<in> refs_of' ko \<and> ps_clear x (objBitsKO ko) s; ksPSpace s thread = Some (KOTCB obj); is_aligned (capEPPtr cap) (objBitsKO (KOEndpoint (Structures_H.endpoint.RecvEP list))); ps_clear (capEPPtr cap) (objBitsKO (KOEndpoint (Structures_H.endpoint.RecvEP list))) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s; thread \<in> set list\<rbrakk> \<Longrightarrow> False
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list obj. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; distinct list; isBlocking; ksPSpace s (capEPPtr cap) = Some (KOEndpoint (Structures_H.endpoint.RecvEP list)); state_refs_of' s (capEPPtr cap) = set list \<times> {EPRecv}; ksPSpace s thread = Some (KOTCB obj); is_aligned (capEPPtr cap) (objBitsKO (KOEndpoint (Structures_H.endpoint.RecvEP list))); ps_clear (capEPPtr cap) (objBitsKO (KOEndpoint (Structures_H.endpoint.RecvEP list))) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s; thread \<in> set list; \<exists>ko. ksPSpace s thread = Some ko \<and> is_aligned thread (objBitsKO ko) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear thread (objBitsKO ko) s; \<exists>ko. ksPSpace s thread = Some ko \<and> is_aligned thread (objBitsKO ko) \<and> (capEPPtr cap, TCBBlockedRecv) \<in> refs_of' ko \<and> ps_clear thread (objBitsKO ko) s\<rbrakk> \<Longrightarrow> False
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 2. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking; state_refs_of' s (capEPPtr cap) = {}\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ep_at' (capEPPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))
 2. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capEPPtr cap) = {}
 3. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isEndpointCap cap; ccap_relation cap capa_; ntfnptr_ \<noteq> Some 0; (rv'_ = 0) = (ntfnptr_ = None \<or> \<not> EndpointDecls_H.isActive rv_); (s_, s'_) \<in> rf_sr; invs' s_; st_tcb_at' simple' thread s_; sch_act_not thread s_; \<forall>d p. thread \<notin> set (ksReadyQueues s_ (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s_; capEPPtr cap \<noteq> thread; state_refs_of' s_ thread = {r \<in> state_refs_of' s_ thread. snd r = TCBBound}; isBlocking; state_refs_of' s_ (capEPPtr cap) = {}\<rbrakk> \<Longrightarrow> tcb_at' thread s_ \<and> Invariants_H.valid_queues s_ \<and> valid_objs' s_ \<and> ep_at' (capEPPtr cap) s_ \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> capEPPtr cap = capEPPtr cap && ~~ mask 4 \<and> valid_pspace' s_ \<and> tcb_at' thread s_ \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s_ \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(thread, EPRecv)} else ((state_refs_of' s_)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) \<union> {r \<in> state_refs_of' s_ thread. snd r = TCBBound})) a) \<and> isBlockedOnReceive (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) proof (prove)
goal (10 subgoals):
 1. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capEPPtr cap) = {}
 2. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>capa ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isBlocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capEPPtr cap) = {}
 2. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s); Invariants_H.valid_queues s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> Invariants_H.valid_queues s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' x3 x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3a \<longrightarrow> x3 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3a \<noteq> [] \<and> (\<forall>t\<in>set x3a. tcb_at' t s) \<and> distinct x3a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 3. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<in> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; x \<in> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 4. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s\<rbrakk> \<Longrightarrow> st_tcb_at' (Not \<circ> runnable') x s
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 5. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p)); sch_act_not x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> sch_act_not x s
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 5. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> sch_act_not x s
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p)); sch_act_not x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 5. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p)); sch_act_wf (ksSchedulerAction s) s\<rbrakk> \<Longrightarrow> sch_act_not x s
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p)); sch_act_not x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 5. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; x \<noteq> thread; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p)); ksSchedulerAction s = SwitchToThread x; st_tcb_at' runnable' x s; tcb_in_cur_domain' x s\<rbrakk> \<Longrightarrow> False
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p)); sch_act_not x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 5. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 6. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 8. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; \<forall>d p. x \<notin> set (ksReadyQueues s (d, p)); sch_act_not x s\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 2. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; x \<in> set list; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 3. \<And>capa ntfnptr rv rv' s s' list x xa. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) s; capEPPtr cap \<noteq> thread; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; Invariants_H.valid_queues s; state_refs_of' s (capEPPtr cap) = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (capEPPtr cap, TCBBlockedSend) \<in> refs_of' ko) x s; x \<notin> set list\<rbrakk> \<Longrightarrow> (\<forall>x1. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.RecvEP x1 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb)))) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> list = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = capEPPtr cap) x s \<and> ko_at' (Structures_H.endpoint.SendEP (x # xa)) (capEPPtr cap) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> sch_act_not x s \<and> thread \<noteq> x \<and> ep_at' (capEPPtr cap) s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>xa xb. x \<notin> set (ksReadyQueues s (xa, xb))))
 4. \<And>capa ep ntfnptr rv rv' s s'. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); ko_at' ep (capEPPtr cap) s; valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> capEPPtr cap \<noteq> thread \<and> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 5. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 7. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 8. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 9. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 10. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s s' obj. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (KOEndpoint ep) s; ksPSpace s (capEPPtr cap) = Some (KOEndpoint ep); ksPSpace s thread = Some (KOTCB obj); is_aligned (capEPPtr cap) (objBitsKO (KOEndpoint ep)); ps_clear (capEPPtr cap) (objBitsKO (KOEndpoint ep)) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>capa ep ntfnptr rv rv' s s' obj. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv); (s, s') \<in> rf_sr; invs' s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (KOEndpoint ep) s; ksPSpace s (capEPPtr cap) = Some (KOEndpoint ep); ksPSpace s thread = Some (KOTCB obj); is_aligned (capEPPtr cap) (objBitsKO (KOEndpoint ep)); ps_clear (capEPPtr cap) (objBitsKO (KOEndpoint ep)) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> tcb_st_refs_of' (tcbState obj) \<union> tcb_bound_refs' (tcbBoundNotification obj) = tcb_bound_refs' (tcbBoundNotification obj)
 2. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 4. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 7. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr rv rv'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0; (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 2. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some a \<Rightarrow> getNotification a \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> (invs' and tcb_at' thread) s) and (\<lambda>s. \<not> ((\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv) \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep (capEPPtr cap) and ko_at' ep (capEPPtr cap)) s)\<rbrace>
 3. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 6. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>capa ep ntfnptr. \<lbrakk>isEndpointCap cap; ccap_relation cap capa; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6978 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x \<Rightarrow> getNotification x \<lbrace>\<lambda>rv. (\<lambda>s. (\<exists>y. ntfnptr = Some y) \<and> EndpointDecls_H.isActive rv \<longrightarrow> invs' s \<and> tcb_at' thread s) and (\<lambda>s. (ntfnptr = None \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) \<and> ko_at' ep (capEPPtr cap) s) \<and> (\<not> EndpointDecls_H.isActive rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) \<and> ko_at' ep (capEPPtr cap) s))\<rbrace>
 2. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and ?R6978 isBlockinga capa threada ep a\<rbrace>
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 5. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga capa threada ep ntfnptr. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnptr \<noteq> Some 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. (rv' = 0) = (ntfnptr = None \<or> \<not> EndpointDecls_H.isActive rv)) ret__int_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfnPtr_'_update (\<lambda>_. option_to_ptr ntfnptr) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (fromJust ntfnptr)\<rbrace>} \<inter> \<lbrace>rv' \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv' \<noteq> 0\<rbrace>)
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and (\<lambda>b. (a = None \<longrightarrow> ((\<exists>y. a = Some y) \<and> EndpointDecls_H.isActive (NTFN Structures_H.ntfn.IdleNtfn None) \<longrightarrow> invs' b \<and> tcb_at' thread b) \<and> (a = None \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b) \<and> (\<not> EndpointDecls_H.isActive (NTFN Structures_H.ntfn.IdleNtfn None) \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b)) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ((\<exists>y. a = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' b \<and> tcb_at' thread b) \<and> (a = None \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b))))\<rbrace>
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 4. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R5881 (from_bool isBlocking) capa (tcb_ptr_to_ctcb_ptr thread) ep\<rbrace> getBoundNotification thread \<lbrace>\<lambda>a. (\<lambda>b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ko_at' ntfn (the a) b))) and (\<lambda>b. (a = None \<longrightarrow> ((\<exists>y. a = Some y) \<and> EndpointDecls_H.isActive (NTFN Structures_H.ntfn.IdleNtfn None) \<longrightarrow> invs' b \<and> tcb_at' thread b) \<and> (a = None \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b) \<and> (\<not> EndpointDecls_H.isActive (NTFN Structures_H.ntfn.IdleNtfn None) \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b)) \<and> (\<forall>x. a = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x b \<longrightarrow> ((\<exists>y. a = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' b \<and> tcb_at' thread b) \<and> (a = None \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues b (d, p))) \<and> ko_at' ep (capEPPtr cap) b))))\<rbrace>
 2. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = option_to_ptr rv \<and> rv \<noteq> Some 0) ntfnPtr_' (\<lambda>a b. {s. a = None \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. a = Some x \<longrightarrow> s \<in> {s'. \<forall>ntfn. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' ntfn x s) \<longrightarrow> s' \<in> UNIV}}})
 3. \<And>isBlockinga capa threada ep. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capEPPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. epptr_'_update (\<lambda>_. ep_Ptr (capEPPtr cap)) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' cap) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' (capEPPtr cap) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr cap) s \<longrightarrow> (no_0_obj' and valid_objs' and ?R5881 isBlockinga capa threada ep and tcb_at' (ctcb_ptr_to_tcb_ptr threada) and (\<lambda>_. True)) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr (capEPPtr cap)))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>isBlockinga capa threada s s'. \<lbrakk>isEndpointCap cap; isBlockinga = from_bool isBlocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) \<and> valid_cap' cap s\<rbrakk> \<Longrightarrow> ep_at' (capEPPtr cap) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr cap) s) \<longrightarrow> no_0_obj' s \<and> valid_objs' s \<and> (\<forall>ntfn. bound_tcb_at' ((=) ntfn) thread s \<longrightarrow> (\<forall>x. ntfn = Some x \<longrightarrow> (\<forall>ntfn. ko_at' ntfn x s \<longrightarrow> EndpointDecls_H.isActive ntfn \<longrightarrow> tcb_at' thread s))) \<and> tcb_at' thread s) proof (prove)
goal:
No subgoals!