theory Finalise_C

lemma cancelAllIPC_ccorres:
  "ccorres dc xfdc
   (invs') (UNIV \<inter> {s. epptr_' s = Ptr epptr}) []
   (cancelAllIPC epptr) (Call cancelAllIPC_'proc)" apply (cinit lift: epptr_') apply (rule ccorres_symb_exec_l [OF _ getEndpoint_inv _ empty_fail_getEndpoint]) apply (rule_tac xf'=ret__unsigned_'
                and val="case ep of IdleEP \<Rightarrow> scast EPState_Idle
                            | RecvEP _ \<Rightarrow> scast EPState_Recv | SendEP _ \<Rightarrow> scast EPState_Send"
                and R="ko_at' ep epptr"
             in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply clarsimp apply (erule cmap_relationE1 [OF cmap_relation_ep]) apply (erule ko_at_projectKO_opt) apply (clarsimp simp add: typ_heap_simps) apply (simp add: cendpoint_relation_def Let_def
                 split: endpoint.split_asm) apply ceqv apply (rule_tac A="invs' and ko_at' ep epptr"
              in ccorres_guard_imp2[where A'=UNIV]) apply wpc apply (rename_tac list) apply (simp add: endpoint_state_defs
                         Collect_False Collect_True
                         ccorres_cond_iffs
                    del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule ccorres_abstract_cleanup) apply csymbr apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2) apply (rule_tac r'=dc and xf'=xfdc
                       in ccorres_split_nothrow) apply (rule_tac P="ko_at' (RecvEP list) epptr and invs'"
                     in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (rule cmap_relationE1 [OF cmap_relation_ep]) apply assumption apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps setEndpoint_def) apply (rule rev_bexI) apply (rule setObject_eq; simp add: objBits_simps')[1] apply (clarsimp simp: rf_sr_def cstate_relation_def
                                  Let_def carch_state_relation_def carch_globals_def
                                  cmachine_state_relation_def) apply (clarsimp simp: cpspace_relation_def
                                  update_ep_map_tos typ_heap_simps') apply (erule(2) cpspace_relation_ep_update_ep) subgoal by (simp add: cendpoint_relation_def endpoint_state_defs) subgoal by simp apply (rule ceqv_refl) apply (simp only: ccorres_seq_skip) apply (rule ccorres_split_nothrow_novcg) apply (rule cancel_all_ccorres_helper) apply ceqv apply (ctac add: rescheduleRequired_ccorres) apply (wp weak_sch_act_wf_lift_linear
                     cancelAllIPC_mapM_x_valid_queues
                  | simp)+ apply (rule mapM_x_wp', wp)+ apply (wp sts_st_tcb') apply (clarsimp split: if_split) apply (rule mapM_x_wp', wp)+ apply (clarsimp simp: valid_tcb_state'_def) apply (simp add: guard_is_UNIV_def) apply (wp set_ep_valid_objs' hoare_vcg_const_Ball_lift
                   weak_sch_act_wf_lift_linear) apply vcg apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (rename_tac list) apply (simp add: endpoint_state_defs Collect_False Collect_True ccorres_cond_iffs
                  del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule ccorres_abstract_cleanup) apply csymbr apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2) apply (rule_tac r'=dc and xf'=xfdc
                     in ccorres_split_nothrow) apply (rule_tac P="ko_at' (SendEP list) epptr and invs'"
                   in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (rule cmap_relationE1 [OF cmap_relation_ep]) apply assumption apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps setEndpoint_def) apply (rule rev_bexI) apply (rule setObject_eq, simp_all add: objBits_simps')[1] apply (clarsimp simp: rf_sr_def cstate_relation_def
                                Let_def carch_state_relation_def carch_globals_def
                                cmachine_state_relation_def) apply (clarsimp simp: cpspace_relation_def typ_heap_simps'
                                update_ep_map_tos) apply (erule(2) cpspace_relation_ep_update_ep) subgoal by (simp add: cendpoint_relation_def endpoint_state_defs) subgoal by simp apply (rule ceqv_refl) apply (simp only: ccorres_seq_skip) apply (rule ccorres_split_nothrow_novcg) apply (rule cancel_all_ccorres_helper) apply ceqv apply (ctac add: rescheduleRequired_ccorres) apply (wp cancelAllIPC_mapM_x_valid_queues) apply (wp mapM_x_wp' weak_sch_act_wf_lift_linear
                   sts_st_tcb' | clarsimp simp: valid_tcb_state'_def split: if_split)+ apply (simp add: guard_is_UNIV_def) apply (wp set_ep_valid_objs' hoare_vcg_const_Ball_lift
                 weak_sch_act_wf_lift_linear) apply vcg apply (clarsimp simp: valid_ep'_def invs_valid_objs' invs_queues) apply (rule cmap_relationE1[OF cmap_relation_ep], assumption) apply (erule ko_at_projectKO_opt) apply (frule obj_at_valid_objs', clarsimp+) apply (clarsimp simp: projectKOs valid_obj'_def valid_ep'_def) subgoal by (auto simp: typ_heap_simps cendpoint_relation_def
                       Let_def tcb_queue_relation'_def
                       invs_valid_objs' valid_objs'_maxDomain valid_objs'_maxPriority
               intro!: obj_at_conj') apply (clarsimp simp: guard_is_UNIV_def) apply (wp getEndpoint_wp) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' (UNIV \<inter> \<lbrace>\<acute>epptr = ep_Ptr epptr\<rbrace>) [] (cancelAllIPC epptr) (Call cancelAllIPC_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?Q523 epptra) (?Q'523 epptra) [SKIP] (do ep <- getEndpoint epptr;
case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> ?Q'523 epptra proof (prove)
goal (3 subgoals):
 1. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?Q529 epptra ep) (?Q'529 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>?Q529 epptra\<rbrace>
 3. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q529 epptra rv s \<longrightarrow> s' \<in> ?Q'529 epptra rv} proof (prove)
goal (6 subgoals):
 1. \<And>epptra ep s. epptra = ep_Ptr epptr \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ep epptr s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)\<rbrace>)
 2. \<And>epptra ep rv' t t'. epptra = ep_Ptr epptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'536 epptra ep rv')
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (?y'536 epptra ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ep s. UNIV \<inter> {s'. ko_at' ep epptr s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ret__unsigned. ret__unsigned = endpoint_CL.state_CL (endpoint_lift (the (cslift sa (ep_Ptr epptr)))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := endpoint_CL.state_CL (endpoint_lift (the (cslift sa (ep_Ptr epptr))))\<rparr>) \<in> rf_sr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift sa (ep_Ptr epptr)))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))}
 2. \<And>epptra ep rv' t t'. epptra = ep_Ptr epptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'536 epptra ep rv')
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (?y'536 epptra ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ep s x. \<lbrakk>ko_at' ep epptr s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>epptra ep rv' t t'. epptra = ep_Ptr epptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'536 epptra ep rv')
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (?y'536 epptra ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ep s x. ko_at' ep epptr s \<Longrightarrow> map_to_eps (ksPSpace s) (?x560 ep s x) = Some (?y560 ep s x)
 2. \<And>ep s x y'. \<lbrakk>ko_at' ep epptr s; map_to_eps (ksPSpace s) (?x560 ep s x) = Some (?y560 ep s x); cendpoint_relation (cslift x) (?y560 ep s x) y'; cslift x (ep_Ptr (?x560 ep s x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 3. \<And>epptra ep rv' t t'. epptra = ep_Ptr epptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'536 epptra ep rv')
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (?y'536 epptra ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ep s x y'. \<lbrakk>ko_at' ep epptr s; map_to_eps (ksPSpace s) epptr = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>epptra ep rv' t t'. epptra = ep_Ptr epptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'536 epptra ep rv')
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (?y'536 epptra ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ep s x y'. \<lbrakk>ko_at' ep epptr s; map_to_eps (ksPSpace s) epptr = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> endpoint_CL.state_CL (endpoint_lift y') = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>epptra ep rv' t t'. epptra = ep_Ptr epptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'536 epptra ep rv')
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (?y'536 epptra ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep rv' t t'. epptra = ep_Ptr epptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'536 epptra ep rv')
 2. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (?y'536 epptra ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?P536 epptra ep) (?Q536 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q536 epptra ep)
 3. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. ?P536 epptra ep and ko_at' ep epptr\<rbrace>
 4. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P536 epptra rv and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (?Q695 epptra ep) (?Q'695 epptra ep) [SKIP] (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> return () | _ \<Rightarrow> do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q695 epptra ep s \<and> s' \<in> ?Q'695 epptra ep
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep x1. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 epptra ep x1) (?R''710 epptra ep x1) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''710 epptra ep x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 epptra ep list) (?R''710 epptra ep list) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''710 epptra ep x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) (?R''710 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(ep_Ptr epptr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''710 epptra ep x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) (?R''710 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(ep_Ptr epptr);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))))))
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''710 epptra ep x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) (?G'753 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned \<inter> {s. ret__unsigned = epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))}) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>thread :== tcb_Ptr ret__unsigned;;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())))))
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'753 epptra ep x v}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) (?G'956 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>thread :== tcb_Ptr ret__unsigned;;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())))))
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> ?G'956 epptra ep x v}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) (?G'967 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))))
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?G'967 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R707 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) (?G'967 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R707 epptra ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?G'967 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1156 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list) (?P'1149 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) [SKIP] (setEndpoint epptr Structures_H.endpoint.IdleEP) (CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (?P1156 epptra ep x and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?P'1149 epptra ep x v \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (ko_at' (Structures_H.endpoint.RecvEP list) epptr and invs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epptra ep list ret__unsigned \<sigma>. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> {s. (ko_at' (Structures_H.endpoint.RecvEP list) epptr and invs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>))))))}
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (?s1238 list \<sigma> x, ?s'1238 list \<sigma> x) \<in> rf_sr
 2. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace (?s1238 list \<sigma> x)) (?x1237 list \<sigma> x) = Some (?y1237 list \<sigma> x)
 3. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace (?s1238 list \<sigma> x)) (?x1237 list \<sigma> x) = Some (?y1237 list \<sigma> x); cendpoint_relation (cslift (?s'1238 list \<sigma> x)) (?y1237 list \<sigma> x) y'; cslift (?s'1238 list \<sigma> x) (ep_Ptr (?x1237 list \<sigma> x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 4. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 7. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 8. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 10. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace \<sigma>) (?x1237 list \<sigma> x) = Some (?y1237 list \<sigma> x)
 2. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) (?x1237 list \<sigma> x) = Some (?y1237 list \<sigma> x); cendpoint_relation (cslift x) (?y1237 list \<sigma> x) y'; cslift x (ep_Ptr (?x1237 list \<sigma> x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 3. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 7. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 10. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> ?x1257 list \<sigma> x y' t endpoint ta endpointa tb endpointb \<in> fst (setObject epptr Structures_H.endpoint.IdleEP \<sigma>)
 2. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ?x1257 list \<sigma> x y' t endpoint ta endpointa tb endpointb of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 7. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 10. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS Structures_H.endpoint.IdleEP)\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))) \<and> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr epptr \<mapsto> endpointb)) ep_Ptr (cendpoint_relation (cslift x))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP endpointb
 2. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP list) \<or> isRecvEP (Structures_H.endpoint.RecvEP list) then set (epQueue (Structures_H.endpoint.RecvEP list)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP list) \<or> isRecvEP (Structures_H.endpoint.RecvEP list) then set (epQueue (Structures_H.endpoint.RecvEP list)) else {}))\<^esub>
 3. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 7. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 10. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) epptr = Some (Structures_H.endpoint.RecvEP list_); cendpoint_relation (cslift x_) (Structures_H.endpoint.RecvEP list_) y'_; cslift x_ (ep_Ptr epptr) = Some y'_; endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)); endpoint_lift endpointa_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_))); endpoint_lift endpointb_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)))); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x_) Structures_H.endpoint.IdleEP endpointb_ proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP list) \<or> isRecvEP (Structures_H.endpoint.RecvEP list) then set (epQueue (Structures_H.endpoint.RecvEP list)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP list) \<or> isRecvEP (Structures_H.endpoint.RecvEP list) then set (epQueue (Structures_H.endpoint.RecvEP list)) else {}))\<^esub>
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) epptr = Some (Structures_H.endpoint.RecvEP list_); cendpoint_relation (cslift x_) (Structures_H.endpoint.RecvEP list_) y'_; cslift x_ (ep_Ptr epptr) = Some y'_; endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)); endpoint_lift endpointa_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_))); endpoint_lift endpointb_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)))); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP list_) \<or> isRecvEP (Structures_H.endpoint.RecvEP list_) then set (epQueue (Structures_H.endpoint.RecvEP list_)) else {}))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP list_) \<or> isRecvEP (Structures_H.endpoint.RecvEP list_) then set (epQueue (Structures_H.endpoint.RecvEP list_)) else {}))\<^esub> proof (prove)
goal (10 subgoals):
 1. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1146 epptra ep list ret__unsigned rv')
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1146 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 5. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 6. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 8. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 10. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 epptra ep list ret__unsigned rv) (?Q'1146 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 4. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 5. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1146 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv) (?Q'1146 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1146 epptra ep list ret__unsigned\<rbrace>
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 4. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 5. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (13 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1336 epptra ep list ret__unsigned rv rv') (?xf'1336 epptra ep list ret__unsigned rv rv') (?P1342 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv) (?Q'1146 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv rv') [] (mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD)
 2. \<And>epptra ep list ret__unsigned rv rv' rv'a t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1336 epptra ep list ret__unsigned rv rv') rv'a t t' (CALL rescheduleRequired_'proc()) (?d'1336 epptra ep list ret__unsigned rv rv' rv'a)
 3. \<And>epptra ep list ret__unsigned rv rv' rva rv'a. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'; ?r'1336 epptra ep list ret__unsigned rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1336 epptra ep list ret__unsigned rv rv' rva) (?Q'1336 epptra ep list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (?d'1336 epptra ep list ret__unsigned rv rv' rv'a)
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1340 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q1336 epptra ep list ret__unsigned rv rv'\<rbrace>
 5. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1336 epptra ep list ret__unsigned rv rv') (?xf'1336 epptra ep list ret__unsigned rv rv') (?Q'1336 epptra ep list ret__unsigned rv rv')
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. ?P1342 epptra ep list ret__unsigned a and ?R1340 epptra ep list ret__unsigned a\<rbrace>
 7. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1146 epptra ep list ret__unsigned rv (xfdc s)}
 8. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 10. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' rv'a t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL rescheduleRequired_'proc()) (?d'1336 epptra ep list ret__unsigned rv rv' rv'a)
 2. \<And>epptra ep list ret__unsigned rv rv' rva rv'a. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1336 epptra ep list ret__unsigned rv rv' rva) (?Q'1336 epptra ep list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (?d'1336 epptra ep list ret__unsigned rv rv' rv'a)
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1340 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q1336 epptra ep list ret__unsigned rv rv'\<rbrace>
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1336 epptra ep list ret__unsigned rv rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R1340 epptra ep list ret__unsigned a\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 7. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 10. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' rva rv'a. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1336 epptra ep list ret__unsigned rv rv' rva) (?Q'1336 epptra ep list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1340 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q1336 epptra ep list ret__unsigned rv rv'\<rbrace>
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1336 epptra ep list ret__unsigned rv rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R1340 epptra ep list ret__unsigned a\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1340 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rva. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs'\<rbrace>
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R1340 epptra ep list ret__unsigned a\<rbrace>
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 5. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 6. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 8. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 10. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (13 subgoals):
 1. \<And>epptra ep list t. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>sch_act_not t\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. sch_act_not t\<rbrace>
 2. \<And>epptra ep list ret__unsigned rv rv' t. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>st_tcb_at' runnable' t\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. st_tcb_at' runnable' t\<rbrace>
 3. \<And>epptra ep list ret__unsigned rv rv' t. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>tcb_in_cur_domain' t\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. tcb_in_cur_domain' t\<rbrace>
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'1376 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. valid_objs'\<rbrace>
 5. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> ?P'1376 epptra ep list ret__unsigned a b)\<rbrace>
 7. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 8. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 10. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' t x. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'; x \<in> set list\<rbrakk> \<Longrightarrow> \<lbrace>?Q1393 epptra ep list ret__unsigned rv rv' t x\<rbrace> setThreadState Structures_H.thread_state.Restart x \<lbrace>\<lambda>xa. st_tcb_at' runnable' t\<rbrace>
 2. \<And>epptra ep list ret__unsigned rv rv' t x s. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'; x \<in> set list; st_tcb_at' runnable' t s\<rbrakk> \<Longrightarrow> ?Q1393 epptra ep list ret__unsigned rv rv' t x s
 3. \<And>epptra ep list ret__unsigned rv rv' t. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>tcb_in_cur_domain' t\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. tcb_in_cur_domain' t\<rbrace>
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'1376 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. valid_objs'\<rbrace>
 5. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> ?P'1376 epptra ep list ret__unsigned a b)\<rbrace>
 7. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 8. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 10. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' t x s. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'; x \<in> set list; st_tcb_at' runnable' t s\<rbrakk> \<Longrightarrow> (if t = x then K (runnable' Structures_H.thread_state.Restart) else st_tcb_at' runnable' t) s
 2. \<And>epptra ep list ret__unsigned rv rv' t. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>tcb_in_cur_domain' t\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. tcb_in_cur_domain' t\<rbrace>
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'1376 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. valid_objs'\<rbrace>
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> ?P'1376 epptra ep list ret__unsigned a b)\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 7. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 9. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 10. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' t. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>tcb_in_cur_domain' t\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. tcb_in_cur_domain' t\<rbrace>
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'1376 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv. valid_objs'\<rbrace>
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> ?P'1376 epptra ep list ret__unsigned a b)\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 6. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' x s. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'; x \<in> set list; valid_objs' s\<rbrakk> \<Longrightarrow> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') s
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)\<rbrace>
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 5. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 6. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 7. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 8. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 10. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)\<rbrace>
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 4. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 5. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)\<rbrace>
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 3. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 5. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R1154 epptra ep x) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 6. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 8. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1146 epptra ep list ret__unsigned\<^esub> (?R'1148 (ep_Ptr epptr) (Structures_H.endpoint.RecvEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 2. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1148 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 epptra ep) (?R''711 epptra ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra ep. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R708 (ep_Ptr epptr) Structures_H.endpoint.IdleEP) (?R''711 (ep_Ptr epptr) Structures_H.endpoint.IdleEP) [SKIP] (return ()) SKIP
 2. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R708 epptra ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''711 epptra ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep x3. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep x3) (?R''712 epptra ep x3) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 epptra ep list) (?R''712 epptra ep list) [SKIP] (do setEndpoint epptr Structures_H.endpoint.IdleEP;
forM_x (epQueue ep) (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(epptra);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptra,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) (?R''712 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(ep_Ptr epptr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) (?R''712 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_head_'proc(ep_Ptr epptr);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))))))
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''712 epptra ep x}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) (?G'1603 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned \<inter> {s. ret__unsigned = epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))}) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>thread :== tcb_Ptr ret__unsigned;;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())))))
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'1603 epptra ep x v}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) (?G'1806 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>thread :== tcb_Ptr ret__unsigned;;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())))))
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> ?G'1806 epptra ep x v}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) (?G'1817 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))))
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?G'1817 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R709 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) (?G'1817 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) [SKIP] (do y <- setEndpoint epptr Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R709 epptra ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?G'1817 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2006 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list) (?P'1999 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) [SKIP] (setEndpoint epptr Structures_H.endpoint.IdleEP) (CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?P2006 epptra ep x and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?P'1999 epptra ep x v \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (ko_at' (Structures_H.endpoint.SendEP list) epptr and invs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra ep list ret__unsigned \<sigma>. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> {s. (ko_at' (Structures_H.endpoint.SendEP list) epptr and invs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>))))))}
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (?s2088 list \<sigma> x, ?s'2088 list \<sigma> x) \<in> rf_sr
 2. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace (?s2088 list \<sigma> x)) (?x2087 list \<sigma> x) = Some (?y2087 list \<sigma> x)
 3. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace (?s2088 list \<sigma> x)) (?x2087 list \<sigma> x) = Some (?y2087 list \<sigma> x); cendpoint_relation (cslift (?s'2088 list \<sigma> x)) (?y2087 list \<sigma> x) y'; cslift (?s'2088 list \<sigma> x) (ep_Ptr (?x2087 list \<sigma> x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 4. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 7. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace \<sigma>) (?x2087 list \<sigma> x) = Some (?y2087 list \<sigma> x)
 2. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) (?x2087 list \<sigma> x) = Some (?y2087 list \<sigma> x); cendpoint_relation (cslift x) (?y2087 list \<sigma> x) y'; cslift x (ep_Ptr (?x2087 list \<sigma> x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 3. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 7. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 8. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 10. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject epptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> ?x2107 list \<sigma> x y' t endpoint ta endpointa tb endpointb \<in> fst (setObject epptr Structures_H.endpoint.IdleEP \<sigma>)
 2. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ?x2107 list \<sigma> x y' t endpoint ta endpointa tb endpointb of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 7. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 8. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 10. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS Structures_H.endpoint.IdleEP)\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))) \<and> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))))) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) epptr \<sigma>; invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr epptr \<mapsto> endpointb)) ep_Ptr (cendpoint_relation (cslift x))
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP endpointb
 2. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP list) \<or> isRecvEP (Structures_H.endpoint.SendEP list) then set (epQueue (Structures_H.endpoint.SendEP list)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP list) \<or> isRecvEP (Structures_H.endpoint.SendEP list) then set (epQueue (Structures_H.endpoint.SendEP list)) else {}))\<^esub>
 3. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 7. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 8. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 10. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) epptr = Some (Structures_H.endpoint.SendEP list_); cendpoint_relation (cslift x_) (Structures_H.endpoint.SendEP list_) y'_; cslift x_ (ep_Ptr epptr) = Some y'_; endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)); endpoint_lift endpointa_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_))); endpoint_lift endpointb_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)))); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x_) Structures_H.endpoint.IdleEP endpointb_ proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr epptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP list) \<or> isRecvEP (Structures_H.endpoint.SendEP list) then set (epQueue (Structures_H.endpoint.SendEP list)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP list) \<or> isRecvEP (Structures_H.endpoint.SendEP list) then set (epQueue (Structures_H.endpoint.SendEP list)) else {}))\<^esub>
 2. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) epptr = Some (Structures_H.endpoint.SendEP list_); cendpoint_relation (cslift x_) (Structures_H.endpoint.SendEP list_) y'_; cslift x_ (ep_Ptr epptr) = Some y'_; endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)); endpoint_lift endpointa_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_))); endpoint_lift endpointb_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointb_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint_) (t_hrs_' (globals x_)))); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP list_) \<or> isRecvEP (Structures_H.endpoint.SendEP list_) then set (epQueue (Structures_H.endpoint.SendEP list_)) else {}))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP list_) \<or> isRecvEP (Structures_H.endpoint.SendEP list_) then set (epQueue (Structures_H.endpoint.SendEP list_)) else {}))\<^esub> proof (prove)
goal (8 subgoals):
 1. \<And>epptra ep list ret__unsigned rv' t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1996 epptra ep list ret__unsigned rv')
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1996 epptra ep list ret__unsigned rv')
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 5. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 6. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 8. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 epptra ep list ret__unsigned rv) (?Q'1996 epptra ep list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1996 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv) (?Q'1996 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>?Q1996 epptra ep list ret__unsigned\<rbrace>
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'2176 epptra ep list ret__unsigned rv rv') (?xf'2176 epptra ep list ret__unsigned rv rv') (?P2182 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv) (?Q'1996 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv rv') [] (mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD)
 2. \<And>epptra ep list ret__unsigned rv rv' rv'a t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2176 epptra ep list ret__unsigned rv rv') rv'a t t' (CALL rescheduleRequired_'proc()) (?d'2176 epptra ep list ret__unsigned rv rv' rv'a)
 3. \<And>epptra ep list ret__unsigned rv rv' rva rv'a. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'; ?r'2176 epptra ep list ret__unsigned rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2176 epptra ep list ret__unsigned rv rv' rva) (?Q'2176 epptra ep list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (?d'2176 epptra ep list ret__unsigned rv rv' rv'a)
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2180 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q2176 epptra ep list ret__unsigned rv rv'\<rbrace>
 5. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2176 epptra ep list ret__unsigned rv rv') (?xf'2176 epptra ep list ret__unsigned rv rv') (?Q'2176 epptra ep list ret__unsigned rv rv')
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. ?P2182 epptra ep list ret__unsigned a and ?R2180 epptra ep list ret__unsigned a\<rbrace>
 7. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1996 epptra ep list ret__unsigned rv (xfdc s)}
 8. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 9. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' rv'a t t'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL rescheduleRequired_'proc()) (?d'2176 epptra ep list ret__unsigned rv rv' rv'a)
 2. \<And>epptra ep list ret__unsigned rv rv' rva rv'a. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2176 epptra ep list ret__unsigned rv rv' rva) (?Q'2176 epptra ep list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (?d'2176 epptra ep list ret__unsigned rv rv' rv'a)
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2180 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q2176 epptra ep list ret__unsigned rv rv'\<rbrace>
 4. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2176 epptra ep list ret__unsigned rv rv')
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2180 epptra ep list ret__unsigned a\<rbrace>
 6. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 7. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 8. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 10. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv' rva rv'a. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2176 epptra ep list ret__unsigned rv rv' rva) (?Q'2176 epptra ep list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2180 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q2176 epptra ep list ret__unsigned rv rv'\<rbrace>
 3. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2176 epptra ep list ret__unsigned rv rv')
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2180 epptra ep list ret__unsigned a\<rbrace>
 5. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 6. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 7. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 9. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2180 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rva. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs'\<rbrace>
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2180 epptra ep list ret__unsigned a\<rbrace>
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 5. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 6. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 8. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'2210 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv s. weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>epptra ep list ret__unsigned rv rv'. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) b \<and> ?P'2210 epptra ep list ret__unsigned a b)\<rbrace>
 4. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 5. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 6. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 8. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rva rv'a. UNIV)
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)\<rbrace>
 3. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 4. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 5. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 7. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R2004 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list\<rbrace> setEndpoint epptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)\<rbrace>
 2. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 3. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and ?R2004 epptra ep x) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 4. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 6. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra ep list ret__unsigned. \<lbrakk>epptra = ep_Ptr epptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1996 epptra ep list ret__unsigned\<^esub> (?R'1998 (ep_Ptr epptr) (Structures_H.endpoint.SendEP list) list ret__unsigned) CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr epptr,0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr epptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 2. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1998 epptra ep x v}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>epptra ep s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; (invs' and ko_at' ep epptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep epptr and invs' and (\<lambda>a. (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v v'. v = epQueue_head_CL (endpoint_lift (the (cslift (endpoint_ptr_'_update (\<lambda>_. epptra) s) (endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = epQueue_head_CL (endpoint_lift (the (cslift s epptra)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptra))\<lparr>endpoint_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c epptra \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t epptra))\<lparr>epQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptra \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptra))\<lparr>epQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update epptra endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. endpoint_ptr_'_update (\<lambda>_. epptra) s \<Turnstile>\<^sub>c endpoint_ptr_' (endpoint_ptr_'_update (\<lambda>_. epptra) s)}}})
 2. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 4. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ep s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ep epptr s\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ko_at' (Structures_H.endpoint.RecvEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s' (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s' (ep_Ptr epptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s' (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s' (ep_Ptr epptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr)
 2. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 4. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ep s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ep epptr s\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace s) (?x2403 ep s s') = Some (?y2403 ep s s')
 2. \<And>ep s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ep epptr s; map_to_eps (ksPSpace s) (?x2403 ep s s') = Some (?y2403 ep s s'); cendpoint_relation (cslift s') (?y2403 ep s s') y'; cslift s' (ep_Ptr (?x2403 ep s s')) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ko_at' (Structures_H.endpoint.RecvEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s' (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s' (ep_Ptr epptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s' (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s' (ep_Ptr epptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr)
 3. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 5. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ep s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ep epptr s; map_to_eps (ksPSpace s) epptr = Some ep; cendpoint_relation (cslift s') ep y'; cslift s' (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ko_at' (Structures_H.endpoint.RecvEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s' (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s' (ep_Ptr epptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s' (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s' (ep_Ptr epptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr)
 2. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 4. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ep s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ep epptr s; map_to_eps (ksPSpace s) epptr = Some ep; cendpoint_relation (cslift s') ep y'; cslift s' (ep_Ptr epptr) = Some y'; (\<forall>ko. projectKO_opt ko = Some ep \<longrightarrow> KOEndpoint ep = ko) \<longrightarrow> valid_obj' (KOEndpoint ep) s\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ko_at' (Structures_H.endpoint.RecvEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr)
 2. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 4. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ep s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ep epptr s; map_to_eps (ksPSpace s) epptr = Some ep; cendpoint_relation (cslift s') ep y'; cslift s' (ep_Ptr epptr) = Some y'; case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ko_at' (Structures_H.endpoint.RecvEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s' \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))))))) \<and> s' \<Turnstile>\<^sub>c ep_Ptr epptr)
 2. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 4. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ep_ epptr s_; map_to_eps (ksPSpace s_) epptr = Some ep_; cendpoint_relation (cslift s'_) ep_ y'_; cslift s'_ (ep_Ptr epptr) = Some y'_; case ep_ of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s_) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s_) \<and> distinct ts\<rbrakk> \<Longrightarrow> (\<forall>x. ep_ = Structures_H.endpoint.RecvEP x \<longrightarrow> ko_at' (Structures_H.endpoint.RecvEP x) epptr s_ \<and> (\<forall>x\<in>set x. tcb_at' x s_ \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> (\<forall>x\<in>set x. tcb_at' x s_) \<and> weak_sch_act_wf (ksSchedulerAction s_) s_) \<and> (\<forall>x. ep_ = Structures_H.endpoint.SendEP x \<longrightarrow> ko_at' (Structures_H.endpoint.SendEP x) epptr s_ \<and> (\<forall>x\<in>set x. tcb_at' x s_ \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> (\<forall>x\<in>set x. tcb_at' x s_) \<and> weak_sch_act_wf (ksSchedulerAction s_) s_) \<and> (\<forall>x. ep_ = Structures_H.endpoint.RecvEP x \<longrightarrow> s'_ \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'_))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift y'_))))))) \<and> s'_ \<Turnstile>\<^sub>c ep_Ptr epptr) \<and> (\<forall>x. ep_ = Structures_H.endpoint.SendEP x \<longrightarrow> s'_ \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals s'_))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (epQueue_head_CL (endpoint_lift y'_))))))) \<and> s'_ \<Turnstile>\<^sub>c ep_Ptr epptr) proof (prove)
goal (3 subgoals):
 1. \<And>epptra ep. epptra = ep_Ptr epptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 2. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 3. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>epptra. epptra = ep_Ptr epptr \<Longrightarrow> \<lbrace>?Q523 epptra\<rbrace> getEndpoint epptr \<lbrace>\<lambda>ep. invs' and ko_at' ep epptr and ko_at' ep epptr\<rbrace>
 2. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q523 epptra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>epptra s s'. \<lbrakk>epptra = ep_Ptr epptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and ko_at' ep epptr and ko_at' ep epptr) s) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv epptr and ko_at' rv epptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal:
No subgoals!