theory Ipc_C

lemma receiveIPC_dequeue_ccorres_helper:
  "ccorres (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_'
           (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and>
                                       blockingObject st = ep) sender
                  and ko_at' (SendEP (sender#rest)) ep) UNIV hs
           (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.IdleEP
                                       | (a#list) \<Rightarrow> Structures_H.SendEP rest))
        (\<acute>queue :== CALL ep_ptr_get_queue(Ptr ep);;
         \<acute>sender :== head_C \<acute>queue;;
         \<acute>queue :== CALL tcbEPDequeue(\<acute>sender,\<acute>queue);;
         CALL ep_ptr_set_queue(Ptr ep,\<acute>queue);;
         IF head_C \<acute>queue = Ptr 0 THEN
             CALL endpoint_ptr_set_state(Ptr ep,scast EPState_Idle)
         FI)" apply (rule ccorres_from_vcg) apply (rule allI) apply (rule conseqPre, vcg) apply (clarsimp split del: if_split) apply (frule ep_blocked_in_queueD [OF pred_tcb'_weakenE]) apply simp apply assumption+ apply (frule (1) ko_at_valid_ep' [OF _ invs_valid_objs']) apply (elim conjE) apply (frule (1) valid_ep_blockedD) apply (elim conjE) apply (frule cmap_relation_ep) apply (erule (1) cmap_relation_ko_atE) apply (intro conjI) apply (erule h_t_valid_clift) apply (rule impI) apply (rule exI) apply (rule conjI) apply (rule_tac x=\<sigma> in exI) apply (intro conjI) apply assumption+ apply (drule (2) ep_to_ep_queue) apply (simp add: tcb_queue_relation'_def) apply (clarsimp simp: typ_heap_simps cendpoint_relation_def Let_def
                   cong: imp_cong split del: if_split) apply (intro conjI impI allI) apply (fastforce simp: h_t_valid_clift) apply (fastforce simp: h_t_valid_clift)
   \<comment> \<open>empty case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (frule iffD1 [OF tcb_queue_head_empty_iff
                          [OF tcb_queue_relation'_queue_rel]]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply (clarsimp simp: cendpoint_relation_def Let_def tcb_queue_relation'_def) apply simp apply (simp add: setEndpoint_def split_def) apply (rule conjI) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def Let_def
                         cpspace_relation_def update_ep_map_tos
                         typ_heap_simps') apply (elim conjE) apply (intro conjI)
             \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
            \<comment> \<open>ep relation\<close> apply (rule cpspace_relation_ep_update_ep, assumption+) apply (simp add: cendpoint_relation_def Let_def EPState_Idle_def
                              tcb_queue_relation'_def) apply simp
           \<comment> \<open>ntfn relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_ep_queue [OF invs_sym'], assumption+) apply simp apply (erule (1) map_to_ko_atI')
          \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: typ_heap_simps') apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption apply (clarsimp simp: cendpoint_relation_def Let_def tcb_queue_relation'_def)
  \<comment> \<open>non-empty case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (frule tcb_queue_head_empty_iff [OF tcb_queue_relation'_queue_rel]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply (clarsimp simp: cendpoint_relation_def Let_def tcb_queue_relation'_def) apply (simp add: setEndpoint_def split_def) apply (rule conjI) apply (rule bexI [OF _ setObject_eq]) apply (frule(1) st_tcb_at_h_t_valid) apply (simp add: rf_sr_def cstate_relation_def Let_def
                        cpspace_relation_def update_ep_map_tos
                        typ_heap_simps') apply (elim conjE) apply (intro conjI)
            \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
           \<comment> \<open>ep relation\<close> apply (rule cpspace_relation_ep_update_ep, assumption+) apply (clarsimp simp: cendpoint_relation_def Let_def
                                  isRecvEP_def isSendEP_def
                                  tcb_queue_relation'_def valid_ep'_def
                           split: endpoint.splits list.splits
                       split del: if_split) apply (subgoal_tac "tcb_at' (if x22 = [] then x21 else last x22) \<sigma>") apply (clarsimp simp: is_aligned_neg_mask
                            dest!: is_aligned_tcb_ptr_to_ctcb_ptr
                        split del: if_split) apply (clarsimp split: if_split) apply simp
          \<comment> \<open>ntfn relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_ep_queue [OF invs_sym'], assumption+) apply simp apply (erule (1) map_to_ko_atI')
         \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: typ_heap_simps') apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption apply (clarsimp simp: cendpoint_relation_def Let_def tcb_queue_relation'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr sender) sender_' (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender and ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep) UNIV hs (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ep);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr ep,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ep,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI) proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender and ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ep);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr ep,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ep,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> sender_' s = tcb_ptr_to_ctcb_ptr sender} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender and ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ep);;
\<acute>sender :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>sender,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(ep_Ptr ep,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ep,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> sender_' s = tcb_ptr_to_ctcb_ptr sender} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. {s. (invs' and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender and ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))) \<longrightarrow> (\<exists>queue. (\<exists>ta. (ta, tcb_'_update (\<lambda>_. tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) (sender_'_update (\<lambda>_. tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) (queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) s))) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb ta) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift s) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift s (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (\<sigma>', s\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (\<sigma>', s\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))))))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x st. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; isBlockedOnSend st \<and> blockingObject st = ep\<rbrakk> \<Longrightarrow> (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ?ep97 \<sigma> x
 2. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ko_at' (?ep'97 \<sigma> x) (?ep97 \<sigma> x) \<sigma>
 3. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> invs' \<sigma>
 4. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; sender \<in> set (epQueue (?ep'97 \<sigma> x)) \<and> (isSendEP (?ep'97 \<sigma> x) \<or> isRecvEP (?ep'97 \<sigma> x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ko_at' (?ep'97 \<sigma> x) ep \<sigma>
 2. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> invs' \<sigma>
 3. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; sender \<in> set (epQueue (?ep'97 \<sigma> x)) \<and> (isSendEP (?ep'97 \<sigma> x) \<or> isRecvEP (?ep'97 \<sigma> x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) \<and> (isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) \<and> (isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest))); valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> [] \<and> (\<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>) \<and> distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest)))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest)))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue121 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue121 \<sigma> x ko') \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set (?queue121 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue121 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (?queue121 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender)))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue121 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue121 \<sigma> x ko') \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set (?queue121 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue121 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (?queue121 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue121 \<sigma> x ko'). tcb_at' tcb \<sigma>) \<and> distinct (?queue121 \<sigma> x ko') \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set (?queue121 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue121 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (?queue121 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>tcb\<in>set (?queue121 \<sigma> x ko'). tcb_at' tcb \<sigma>
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> distinct (?queue121 \<sigma> x ko')
 4. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set (?queue121 \<sigma> x ko')
 5. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (?queue121 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 6. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (?queue121 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue121 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest)))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (epQueue (Structures_H.endpoint.SendEP (sender # rest))) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); ep_queue_relation' (cslift x) (epQueue (Structures_H.endpoint.SendEP (sender # rest))) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest)))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (epQueue (Structures_H.endpoint.SendEP (sender # rest))) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (epQueue (Structures_H.endpoint.SendEP (sender # rest))) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender))) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep
 3. \<And>\<sigma> x ko' t ta tb. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<forall>td\<in>set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest). tcb_at' td (?s216 \<sigma> x ko' t ta tb tc ep' endpoint)
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint td. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); td \<in> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest)\<rbrakk> \<Longrightarrow> td \<in> set rest
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint td. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<subseteq> set rest
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> (\<exists>xa\<in>fst (setObject ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (snd xa, x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (snd xa, x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep \<mapsto> injectKOS (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest))\<rparr>), x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift t) (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) endpoint
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 10. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 10. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 10. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr291 \<sigma> x ko' t ta tb tc ep' endpoint p a a' b b') \<sigma>
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr291 \<sigma> x ko' t ta tb tc ep' endpoint p a a' b b') \<sigma>
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 10. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 9. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 8. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 9. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 7. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 8. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 5. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 6. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 4. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 5. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 3. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P230 \<sigma> x ko' t ta tb tc ep' endpoint) ep \<sigma>
 2. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ep' endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; sender \<in> set (epQueue (Structures_H.endpoint.SendEP (sender # rest))); isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); epQueue (Structures_H.endpoint.SendEP (sender # rest)) \<noteq> []; \<forall>t\<in>set (epQueue (Structures_H.endpoint.SendEP (sender # rest))). tcb_at' t \<sigma>; distinct (epQueue (Structures_H.endpoint.SendEP (sender # rest))); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) (epQueue (Structures_H.endpoint.SendEP (sender # rest)))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<forall>tc\<in>set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest). tcb_at' tc (?s325 \<sigma> x ko' t ta tb ep')
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' tc. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tc \<in> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest)\<rbrakk> \<Longrightarrow> tc \<in> set rest
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' tc. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<subseteq> set rest
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<exists>xa\<in>fst (setObject ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (snd xa, x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ep (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) \<sigma>). (snd xa, x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep \<mapsto> injectKOS (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest))\<rparr>), x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep \<mapsto> injectKOS (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest))\<rparr>), x\<lparr>sender_' := tcb_Ptr (epQueue_head_CL (endpoint_lift ko')), queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest)))) ((cslift x)(ep_Ptr ep \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift t) (case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP rest) ep'
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # x21 # x22)) ep \<sigma>; cslift x (ep_Ptr ep) = Some ko'; tcb_at' sender \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr sender; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send; tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender; cslift x (tcb_ptr_to_ctcb_ptr sender) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; sender \<noteq> x21; sender \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr sender; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb)\<rbrakk> \<Longrightarrow> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22) \<and> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr x21 \<and> (\<exists>tcb. cslift t (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) = Some tcb \<and> tcbEPPrev_C tcb = NULL \<and> ep_queue_relation (cslift t) x22 (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) (tcbEPNext_C tcb))
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # x21 # x22)) ep \<sigma>; cslift x (ep_Ptr ep) = Some ko'; tcb_at' sender \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr sender; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send; tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender; cslift x (tcb_ptr_to_ctcb_ptr sender) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; sender \<noteq> x21; sender \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr sender; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb); tcb_at' (if x22 = [] then x21 else last x22) \<sigma>\<rbrakk> \<Longrightarrow> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22) \<and> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr x21 \<and> (\<exists>tcb. cslift t (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) = Some tcb \<and> tcbEPPrev_C tcb = NULL \<and> ep_queue_relation (cslift t) x22 (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) (tcbEPNext_C tcb))
 2. \<And>\<sigma> x ko' t ta tb ep' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # x21 # x22)) ep \<sigma>; cslift x (ep_Ptr ep) = Some ko'; tcb_at' sender \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr sender; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send; tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender; cslift x (tcb_ptr_to_ctcb_ptr sender) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; sender \<noteq> x21; sender \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr sender; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb)\<rbrakk> \<Longrightarrow> tcb_at' (if x22 = [] then x21 else last x22) \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 9. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 10. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # x21 # x22)) ep \<sigma>; cslift x (ep_Ptr ep) = Some ko'; tcb_at' sender \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr sender; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send; tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender; cslift x (tcb_ptr_to_ctcb_ptr sender) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; sender \<noteq> x21; sender \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr sender; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb)\<rbrakk> \<Longrightarrow> tcb_at' (if x22 = [] then x21 else last x22) \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)) then set (epQueue (Structures_H.endpoint.SendEP (sender # rest))) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.SendEP (sender # rest))))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ep' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr444 \<sigma> x ko' t ta tb ep' p a a' b b') \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr444 \<sigma> x ko' t ta tb ep' p a a' b b') \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 7. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 5. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 4. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P338 \<sigma> x ko' t ta tb ep') ep \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ep) sender \<sigma>; ko_at' (Structures_H.endpoint.SendEP (sender # rest)) ep \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ep' (Structures_H.endpoint.SendEP (sender # rest)) \<sigma>; isSendEP (Structures_H.endpoint.SendEP (sender # rest)) \<or> isRecvEP (Structures_H.endpoint.SendEP (sender # rest)); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP (sender # rest)) ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) \<noteq> []; tcb_at' sender \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; sender \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift ep' = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) = sender then rest else sender # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (epQueue_head_CL (endpoint_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr sender) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) = tcb_ptr_to_ctcb_ptr sender proof (prove)
goal:
No subgoals!