theory KHeap_DR

lemma get_endpoint_pick:
  "\<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint)\<rbrakk>
  \<Longrightarrow> valid_ep_abstract endpoint epptr s" apply (clarsimp simp:valid_ep_abstract_def) apply (case_tac  endpoint) apply (clarsimp simp:valid_state_def valid_pspace_def sym_refs_def) apply (clarsimp simp:none_is_sending_ep_def none_is_receiving_ep_def) apply (rule conjI) apply (rule set_eqI) apply (clarsimp simp:ep_waiting_set_send_def) apply (rename_tac ptr t payload) apply (drule_tac x=ptr in spec) apply (clarsimp simp: state_refs_of_def) apply (rule set_eqI) apply (clarsimp simp:ep_waiting_set_recv_def) apply (rename_tac ptr t payload) apply (drule_tac x=ptr in spec) apply (clarsimp simp:state_refs_of_def) apply (clarsimp simp:valid_state_def valid_pspace_def valid_objs_def) apply (drule_tac x=epptr in bspec) apply (clarsimp simp:dom_def) apply (clarsimp simp:valid_obj_def valid_ep_def) apply (rule conjI) apply (rule sym) apply (rule antisym) apply (clarsimp simp:ep_waiting_set_send_def sym_refs_def) apply (rename_tac ptr t payload) apply (drule_tac x=ptr in spec) apply (clarsimp simp:state_refs_of_def) apply (clarsimp simp:ep_waiting_set_send_def sym_refs_def) apply (drule_tac x= epptr in spec) apply (clarsimp simp:state_refs_of_def ep_waiting_set_send_def split:option.splits) apply (drule_tac x= x in bspec) apply simp apply clarsimp apply (case_tac y) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
               split:Structures_A.kernel_object.splits)+ apply (force simp:tcb_bound_refs_def2 split:Structures_A.thread_state.splits) apply (clarsimp simp:ep_waiting_set_send_def) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
             split:Structures_A.kernel_object.splits)+ apply (clarsimp split:Structures_A.endpoint.splits) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
            split:Structures_A.kernel_object.splits)+ apply (clarsimp simp: ntfn_bound_refs_def2 split:Structures_A.ntfn.splits) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
           split:Structures_A.kernel_object.splits)+ apply (rule conjI) apply (clarsimp simp:none_is_receiving_ep_def) apply (rule set_eqI) apply (clarsimp simp: ep_waiting_set_recv_def sym_refs_def) apply (rename_tac ptr t payload) apply (drule_tac x = ptr in spec) apply (clarsimp simp:state_refs_of_def) apply clarsimp defer apply (clarsimp simp:valid_state_def valid_pspace_def valid_objs_def) apply (drule_tac x=epptr in bspec) apply (clarsimp simp:dom_def) apply (clarsimp simp:valid_obj_def valid_ep_def) apply (rule conjI) apply (rule sym) apply (rule antisym) apply (clarsimp simp:ep_waiting_set_recv_def sym_refs_def) apply (rename_tac ptr t payload) apply (drule_tac x = ptr in spec) apply (clarsimp simp:state_refs_of_def) apply (clarsimp simp:ep_waiting_set_recv_def sym_refs_def) apply (drule_tac x= epptr in spec) apply (clarsimp simp:state_refs_of_def ep_waiting_set_recv_def split:option.splits) apply (drule_tac x= x in bspec) apply simp apply clarsimp apply (case_tac y) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
               split:Structures_A.kernel_object.splits)+ apply (force simp: tcb_bound_refs_def2 split:Structures_A.thread_state.splits) apply (clarsimp simp:ep_waiting_set_recv_def) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
             split:Structures_A.kernel_object.splits)+ apply (clarsimp split:Structures_A.endpoint.splits) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
           split:Structures_A.kernel_object.splits)+ apply (clarsimp simp: ntfn_bound_refs_def2 split:Structures_A.ntfn.splits) apply (clarsimp simp:refs_of_def tcb_st_refs_of_def ep_q_refs_of_def ntfn_q_refs_of_def
           split:Structures_A.kernel_object.splits)+ apply (rule conjI) apply (clarsimp simp:none_is_sending_ep_def) apply (rule set_eqI) apply (clarsimp simp: ep_waiting_set_send_def sym_refs_def) apply (rename_tac ptr t payload) apply (drule_tac x = ptr in spec) apply (clarsimp simp:state_refs_of_def) apply (rename_tac list) apply clarsimp apply (subgoal_tac "ko_at (Endpoint (Structures_A.endpoint.RecvEP list)) epptr s
                    \<and> ko_at (Endpoint (Structures_A.endpoint.RecvEP list)) p' s") apply (clarsimp simp: neq_Nil_conv) apply (drule(1) sym_refs_ko_atD)+ apply (clarsimp simp: st_tcb_at_refs_of_rev st_tcb_def2) apply (clarsimp simp: obj_at_def) apply (rename_tac list p') apply (subgoal_tac "ko_at (Endpoint (Structures_A.endpoint.SendEP list)) epptr s
                    \<and> ko_at (Endpoint (Structures_A.endpoint.SendEP list)) p' s") apply (clarsimp simp: neq_Nil_conv) apply (drule(1) sym_refs_ko_atD)+ apply (clarsimp simp: st_tcb_at_refs_of_rev st_tcb_def2) apply (clarsimp simp:obj_at_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint)\<rbrakk> \<Longrightarrow> valid_ep_abstract endpoint epptr s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint)\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = IdleEP\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s = {} \<and> ep_waiting_set_recv epptr s = {}
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s = {}
 2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = {}
 3. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> (x \<in> ep_waiting_set_send epptr s) = (x \<in> {})
 2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = {}
 3. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; kheap s x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = {}
 3. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = {}
 3. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; \<forall>x\<in>state_refs_of s ptr. case x of (y, tp) \<Rightarrow> (ptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = {}
 3. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = {}
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> (x \<in> ep_waiting_set_recv epptr s) = (x \<in> {})
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; kheap s x = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint IdleEP); endpoint = IdleEP; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; \<forall>x\<in>state_refs_of s ptr. case x of (y, tp) \<Rightarrow> (ptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = SendEP x2\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; \<forall>ptr\<in>dom (kheap s). \<exists>obj. kheap s ptr = Some obj \<and> valid_obj ptr obj s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> x2 \<noteq> [] \<and> set x2 = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> epptr \<in> dom (kheap s)
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; \<exists>obj. kheap s epptr = Some obj \<and> valid_obj epptr obj s\<rbrakk> \<Longrightarrow> x2 \<noteq> [] \<and> set x2 = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; \<exists>obj. kheap s epptr = Some obj \<and> valid_obj epptr obj s\<rbrakk> \<Longrightarrow> x2 \<noteq> [] \<and> set x2 = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> set x2 = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> set x2 = ep_waiting_set_send epptr s
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s = set x2
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s \<subseteq> set x2
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> set x2 \<subseteq> ep_waiting_set_send epptr s
 3. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x2 x t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; kheap s x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> x \<in> set x2
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> set x2 \<subseteq> ep_waiting_set_send epptr s
 3. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x2 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> ptr \<in> set x2
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> set x2 \<subseteq> ep_waiting_set_send epptr s
 3. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x2 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; \<forall>x\<in>state_refs_of s ptr. case x of (y, tp) \<Rightarrow> (ptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> ptr \<in> set x2
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> set x2 \<subseteq> ep_waiting_set_send epptr s
 3. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> set x2 \<subseteq> ep_waiting_set_send epptr s
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; \<forall>x\<in>state_refs_of s epptr. case x of (y, tp) \<Rightarrow> (epptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x. \<lbrakk>\<forall>x\<in>set x2. (\<exists>y. kheap s x = Some y) \<and> (\<forall>x2. kheap s x = Some x2 \<longrightarrow> (epptr, TCBBlockedSend) \<in> refs_of x2); kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x2 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2\<rbrakk> \<Longrightarrow> x \<in> set x2
 2. \<And>x2 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (\<exists>y. kheap s x = Some y) \<and> (\<forall>x2. kheap s x = Some x2 \<longrightarrow> (epptr, TCBBlockedSend) \<in> refs_of x2)\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (\<exists>y. kheap s x = Some y) \<and> (\<forall>x2. kheap s x = Some x2 \<longrightarrow> (epptr, TCBBlockedSend) \<in> refs_of x2)\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x y. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (7 subgoals):
 1. \<And>x2 x y x11 x12. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.CNode x11 x12\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2 x y x2a. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = TCB x2a\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2 x y x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Endpoint x3\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 4. \<And>x2 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 5. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 6. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 7. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (6 subgoals):
 1. \<And>x2 x x2a. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> (case tcb_state x2a of BlockedOnReceive x payl \<Rightarrow> {(x, TCBBlockedRecv)} | BlockedOnSend x payl \<Rightarrow> {(x, TCBBlockedSend)} | BlockedOnNotification x \<Rightarrow> {(x, TCBSignal)} | _ \<Rightarrow> {}) \<or> (epptr, TCBBlockedSend) \<in> tcb_bound_refs (tcb_bound_notification x2a); kheap s x = Some (TCB x2a)\<rbrakk> \<Longrightarrow> \<exists>payload. tcb_state x2a = BlockedOnSend epptr payload
 2. \<And>x2 x y x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Endpoint x3\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 4. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 5. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 6. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (5 subgoals):
 1. \<And>x2 x y x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Endpoint x3\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 4. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 5. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (5 subgoals):
 1. \<And>x2 x x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> ep_q_refs_of x3; kheap s x = Some (kernel_object.Endpoint x3)\<rbrakk> \<Longrightarrow> False
 2. \<And>x2 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 4. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 5. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (5 subgoals):
 1. \<And>x2 x x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> (case x3 of IdleEP \<Rightarrow> {} | SendEP q \<Rightarrow> set q \<times> {EPSend} | RecvEP q \<Rightarrow> set q \<times> {EPRecv}); kheap s x = Some (kernel_object.Endpoint x3)\<rbrakk> \<Longrightarrow> False
 2. \<And>x2 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 4. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 5. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x2 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (4 subgoals):
 1. \<And>x2 x x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> (case ntfn_obj x4 of WaitingNtfn q \<Rightarrow> set q \<times> {NTFNSignal} | _ \<Rightarrow> {}) \<or> (epptr, TCBBlockedSend) \<in> ntfn_bound_refs (ntfn_bound_tcb x4); kheap s x = Some (kernel_object.Notification x4)\<rbrakk> \<Longrightarrow> False
 2. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 3. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; x \<in> set x2; (epptr, TCBBlockedSend) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> none_is_receiving_ep epptr s
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = {}
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> (x \<in> ep_waiting_set_recv epptr s) = (x \<in> {})
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 x t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; kheap s x = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (3 subgoals):
 1. \<And>x2 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; \<forall>x\<in>state_refs_of s ptr. case x of (y, tp) \<Rightarrow> (ptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (SendEP x2)); endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> epptr = p'
 2. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>valid_state s; kheap s epptr = Some (kernel_object.Endpoint endpoint); endpoint = RecvEP x3\<rbrakk> \<Longrightarrow> case endpoint of IdleEP \<Rightarrow> none_is_sending_ep epptr s \<and> none_is_receiving_ep epptr s | SendEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_send epptr s \<and> none_is_receiving_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p') | RecvEP queue \<Rightarrow> queue \<noteq> [] \<and> set queue = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. kheap s epptr = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; \<forall>ptr\<in>dom (kheap s). \<exists>obj. kheap s ptr = Some obj \<and> valid_obj ptr obj s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> x3 \<noteq> [] \<and> set x3 = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> epptr \<in> dom (kheap s)
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; \<exists>obj. kheap s epptr = Some obj \<and> valid_obj epptr obj s\<rbrakk> \<Longrightarrow> x3 \<noteq> [] \<and> set x3 = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; \<exists>obj. kheap s epptr = Some obj \<and> valid_obj epptr obj s\<rbrakk> \<Longrightarrow> x3 \<noteq> [] \<and> set x3 = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> set x3 = ep_waiting_set_recv epptr s \<and> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> set x3 = ep_waiting_set_recv epptr s
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s = set x3
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (4 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s \<subseteq> set x3
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> set x3 \<subseteq> ep_waiting_set_recv epptr s
 3. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (4 subgoals):
 1. \<And>x3 x t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; kheap s x = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> x \<in> set x3
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> set x3 \<subseteq> ep_waiting_set_recv epptr s
 3. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (4 subgoals):
 1. \<And>x3 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> ptr \<in> set x3
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> set x3 \<subseteq> ep_waiting_set_recv epptr s
 3. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (4 subgoals):
 1. \<And>x3 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; \<forall>x\<in>state_refs_of s ptr. case x of (y, tp) \<Rightarrow> (ptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> ptr \<in> set x3
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> set x3 \<subseteq> ep_waiting_set_recv epptr s
 3. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> set x3 \<subseteq> ep_waiting_set_recv epptr s
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; \<forall>x\<in>state_refs_of s epptr. case x of (y, tp) \<Rightarrow> (epptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x. \<lbrakk>\<forall>x\<in>set x3. (\<exists>y. kheap s x = Some y) \<and> (\<forall>x2. kheap s x = Some x2 \<longrightarrow> (epptr, TCBBlockedRecv) \<in> refs_of x2); kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (4 subgoals):
 1. \<And>x3 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3\<rbrakk> \<Longrightarrow> x \<in> set x3
 2. \<And>x3 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (\<exists>y. kheap s x = Some y) \<and> (\<forall>x2. kheap s x = Some x2 \<longrightarrow> (epptr, TCBBlockedRecv) \<in> refs_of x2)\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (\<exists>y. kheap s x = Some y) \<and> (\<forall>x2. kheap s x = Some x2 \<longrightarrow> (epptr, TCBBlockedRecv) \<in> refs_of x2)\<rbrakk> \<Longrightarrow> \<exists>t. kheap s x = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x y. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (7 subgoals):
 1. \<And>x3 x y x11 x12. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.CNode x11 x12\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3 x y x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = TCB x2\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3 x y x3a. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Endpoint x3a\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 4. \<And>x3 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 5. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 6. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 7. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (6 subgoals):
 1. \<And>x3 x x2. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> (case tcb_state x2 of BlockedOnReceive x payl \<Rightarrow> {(x, TCBBlockedRecv)} | BlockedOnSend x payl \<Rightarrow> {(x, TCBBlockedSend)} | BlockedOnNotification x \<Rightarrow> {(x, TCBSignal)} | _ \<Rightarrow> {}) \<or> (epptr, TCBBlockedRecv) \<in> tcb_bound_refs (tcb_bound_notification x2); kheap s x = Some (TCB x2)\<rbrakk> \<Longrightarrow> \<exists>payload. tcb_state x2 = BlockedOnReceive epptr payload
 2. \<And>x3 x y x3a. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Endpoint x3a\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 4. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 5. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 6. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (5 subgoals):
 1. \<And>x3 x y x3a. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Endpoint x3a\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 4. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 5. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (5 subgoals):
 1. \<And>x3 x x3a. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> ep_q_refs_of x3a; kheap s x = Some (kernel_object.Endpoint x3a)\<rbrakk> \<Longrightarrow> False
 2. \<And>x3 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 4. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 5. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (5 subgoals):
 1. \<And>x3 x x3a. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> (case x3a of IdleEP \<Rightarrow> {} | SendEP q \<Rightarrow> set q \<times> {EPSend} | RecvEP q \<Rightarrow> set q \<times> {EPRecv}); kheap s x = Some (kernel_object.Endpoint x3a)\<rbrakk> \<Longrightarrow> False
 2. \<And>x3 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 4. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 5. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (4 subgoals):
 1. \<And>x3 x y x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = kernel_object.Notification x4\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (4 subgoals):
 1. \<And>x3 x x4. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> (case ntfn_obj x4 of WaitingNtfn q \<Rightarrow> set q \<times> {NTFNSignal} | _ \<Rightarrow> {}) \<or> (epptr, TCBBlockedRecv) \<in> ntfn_bound_refs (ntfn_bound_tcb x4); kheap s x = Some (kernel_object.Notification x4)\<rbrakk> \<Longrightarrow> False
 2. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 3. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 4. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x y x5. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; x \<in> set x3; (epptr, TCBBlockedRecv) \<in> refs_of y; kheap s x = Some y; y = ArchObj x5\<rbrakk> \<Longrightarrow> \<exists>t. y = TCB t \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s \<and> (\<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p')
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> none_is_sending_ep epptr s
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s = {}
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> (x \<in> ep_waiting_set_send epptr s) = (x \<in> {})
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 x t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; kheap s x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_refs_of s y; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> False
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>x3 ptr t payload. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; \<forall>x. \<forall>xa\<in>state_hyp_refs_of s x. case xa of (y, tp) \<Rightarrow> (x, symreftype tp) \<in> state_hyp_refs_of s y; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; kheap s ptr = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; \<forall>x\<in>state_refs_of s ptr. case x of (y, tp) \<Rightarrow> (ptr, symreftype tp) \<in> state_refs_of s y\<rbrakk> \<Longrightarrow> False
 2. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p'
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP x3)); endpoint = RecvEP x3; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> epptr = p'
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>list. \<lbrakk>kheap s epptr = Some (kernel_object.Endpoint (RecvEP list)); endpoint = RecvEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list\<rbrakk> \<Longrightarrow> \<forall>p'. Some (kernel_object.Endpoint (RecvEP list)) = kheap s p' \<longrightarrow> epptr = p'
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (RecvEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (RecvEP list)) = kheap s p'; ko_at (kernel_object.Endpoint (RecvEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (RecvEP list)) p' s\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (RecvEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (RecvEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (RecvEP list)) p' s
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>p' y ys. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP (y # ys); pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) p' s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (RecvEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (RecvEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (RecvEP list)) p' s
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (3 subgoals):
 1. \<And>p' y ys. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP (y # ys); pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p'; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; state_refs_of s epptr = refs_of (kernel_object.Endpoint (RecvEP (y # ys))) \<and> (\<forall>(x, tp)\<in>refs_of (kernel_object.Endpoint (RecvEP (y # ys))). obj_at (\<lambda>ko. (epptr, symreftype tp) \<in> refs_of ko) x s); state_refs_of s p' = refs_of (kernel_object.Endpoint (RecvEP (y # ys))) \<and> (\<forall>(x, tp)\<in>refs_of (kernel_object.Endpoint (RecvEP (y # ys))). obj_at (\<lambda>ko. (p', symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (RecvEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (RecvEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (RecvEP list)) p' s
 3. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = RecvEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (RecvEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (RecvEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (RecvEP list)) p' s
 2. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (1 subgoal):
 1. \<And>x2 p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP x2; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; x2 \<noteq> []; \<forall>t\<in>set x2. tcb_at t s; distinct x2; Some (kernel_object.Endpoint (SendEP x2)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (1 subgoal):
 1. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (SendEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> epptr = p' proof (prove)
goal (2 subgoals):
 1. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (SendEP list)) = kheap s p'; ko_at (kernel_object.Endpoint (SendEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (SendEP list)) p' s\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (SendEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (SendEP list)) p' s proof (prove)
goal (2 subgoals):
 1. \<And>p' y ys. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP (y # ys); pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; Some (kernel_object.Endpoint (SendEP (y # ys))) = kheap s p'; ko_at (kernel_object.Endpoint (SendEP (y # ys))) epptr s; ko_at (kernel_object.Endpoint (SendEP (y # ys))) p' s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (SendEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (SendEP list)) p' s proof (prove)
goal (2 subgoals):
 1. \<And>p' y ys. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP (y # ys); pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; Some (kernel_object.Endpoint (SendEP (y # ys))) = kheap s p'; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; state_refs_of s epptr = refs_of (kernel_object.Endpoint (SendEP (y # ys))) \<and> (\<forall>(x, tp)\<in>refs_of (kernel_object.Endpoint (SendEP (y # ys))). obj_at (\<lambda>ko. (epptr, symreftype tp) \<in> refs_of ko) x s); state_refs_of s p' = refs_of (kernel_object.Endpoint (SendEP (y # ys))) \<and> (\<forall>(x, tp)\<in>refs_of (kernel_object.Endpoint (SendEP (y # ys))). obj_at (\<lambda>ko. (p', symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> epptr = p'
 2. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (SendEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (SendEP list)) p' s proof (prove)
goal (1 subgoal):
 1. \<And>list p'. \<lbrakk>kheap s epptr = kheap s p'; endpoint = SendEP list; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; Some (kernel_object.Endpoint (SendEP list)) = kheap s p'\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP list)) epptr s \<and> ko_at (kernel_object.Endpoint (SendEP list)) p' s proof (prove)
goal:
No subgoals!