theory Fastpath_C

lemma fastpath_dequeue_ccorres:
  "dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow>
   ccorres dc xfdc
       (ko_at' (RecvEP (dest # xs)) ep_ptr and invs')
            {s. dest2 = tcb_ptr_to_ctcb_ptr dest
               \<and> dest1 = tcb_ptr_to_ctcb_ptr dest
               \<and> ep_ptr1 = ep_Ptr ep_ptr} hs
   (setEndpoint ep_ptr (case xs of [] \<Rightarrow> IdleEP | _ \<Rightarrow> RecvEP xs))
   (Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t dest1\<rbrace>
     (CALL endpoint_ptr_set_epQueue_head_np(ep_ptr1,ptr_val (h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))));;
      Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t dest1\<rbrace>
     (IF h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<noteq> tcb_Ptr 0 THEN
      Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rbrace>
       (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (
       (ptr_basic_update (\<lambda>s. tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals s)))
                                (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (\<lambda>_. NULL))))
      ELSE
        CALL endpoint_ptr_mset_epQueue_tail_state(ep_ptr1,0,scast EPState_Idle)
      FI))" unfolding setEndpoint_def apply (rule setObject_ccorres_helper[rotated]) apply simp apply (simp add: objBits_simps') apply (rule conseqPre, vcg) apply clarsimp apply (drule(1) ko_at_obj_congD') apply (frule ko_at_valid_ep', clarsimp) apply (rule cmap_relationE1[OF cmap_relation_ep], assumption,
         erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps' valid_ep'_def
                        isRecvEP_endpoint_case neq_Nil_conv) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: typ_heap_simps') apply (case_tac "xs") apply (clarsimp simp: cendpoint_relation_def Let_def
                         isRecvEP_endpoint_case
                         tcb_queue_relation'_def
                         typ_heap_simps' endpoint_state_defs) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def update_ep_map_tos
                          typ_heap_simps') apply (erule(1) cpspace_relation_ep_update_ep2) apply (simp add: cendpoint_relation_def endpoint_state_defs) apply simp apply (simp add: carch_state_relation_def cmachine_state_relation_def
                    h_t_valid_clift_Some_iff update_ep_map_tos
                    typ_heap_simps') apply (clarsimp simp: neq_Nil_conv cendpoint_relation_def Let_def
                        isRecvEP_endpoint_case tcb_queue_relation'_def
                        typ_heap_simps' endpoint_state_defs) apply (clarsimp simp: is_aligned_weaken[OF is_aligned_tcb_ptr_to_ctcb_ptr]
                        tcb_at_not_NULL) apply (drule(1) obj_at_cslift_tcb)+ apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                        typ_heap_simps' tcb_at_not_NULL[OF obj_at'_weakenE, OF _ TrueI]) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def update_ep_map_tos
                         update_tcb_map_tos typ_heap_simps') apply (rule conjI, erule ctcb_relation_null_queue_ptrs) apply (rule ext, simp add: tcb_null_queue_ptrs_def
                        split: if_split) apply (rule conjI) apply (rule cpspace_relation_ep_update_ep, assumption+) apply (simp add: Let_def cendpoint_relation_def EPState_Recv_def) apply (simp add: tcb_queue_relation'_def tcb_queue_update_other) apply (simp add: isRecvEP_def) apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_ep_queue [OF invs_sym'], assumption+) apply (simp add: isRecvEP_def) apply simp apply (erule (1) map_to_ko_atI') apply (simp add: carch_state_relation_def typ_heap_simps'
                   cmachine_state_relation_def h_t_valid_clift_Some_iff
                   update_ep_map_tos) apply (erule cready_queues_relation_null_queue_ptrs) apply (rule ext, simp add: tcb_null_ep_ptrs_def split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> ccorres dc xfdc (ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr and invs') \<lbrace>dest2 = tcb_ptr_to_ctcb_ptr dest \<and> dest1 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr\<rbrace> hs (setEndpoint ep_ptr (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_ptr1,ptr_val (h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (IF h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))} (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL))))
ELSE
  CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_ptr1,0,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI)) proof (prove)
goal (1 subgoal):
 1. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> ccorres dc xfdc (ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr and invs') \<lbrace>dest2 = tcb_ptr_to_ctcb_ptr dest \<and> dest1 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr\<rbrace> hs (setObject ep_ptr (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_ptr1,ptr_val (h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (IF h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))} (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL))))
ELSE
  CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_ptr1,0,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI)) proof (prove)
goal (3 subgoals):
 1. \<And>ko. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> updateObject ko = updateObject_default ko
 2. \<And>ko. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> 1 < 2 ^ objBits ko
 3. \<And>\<sigma> ko'. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr and invs') \<sigma> \<and> s \<in> \<lbrace>dest2 = tcb_ptr_to_ctcb_ptr dest \<and> dest1 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr\<rbrace> \<and> ko_at' ko' ep_ptr \<sigma>} Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_ptr1,ptr_val (h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (IF h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))} (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL))))
ELSE
  CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_ptr1,0,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI) {s. (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> injectKOS (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, s) \<in> rf_sr} proof (prove)
goal (2 subgoals):
 1. \<And>ko. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> 1 < 2 ^ objBits ko
 2. \<And>\<sigma> ko'. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr and invs') \<sigma> \<and> s \<in> \<lbrace>dest2 = tcb_ptr_to_ctcb_ptr dest \<and> dest1 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr\<rbrace> \<and> ko_at' ko' ep_ptr \<sigma>} Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_ptr1,ptr_val (h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (IF h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))} (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL))))
ELSE
  CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_ptr1,0,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI) {s. (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> injectKOS (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, s) \<in> rf_sr} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko'. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr and invs') \<sigma> \<and> s \<in> \<lbrace>dest2 = tcb_ptr_to_ctcb_ptr dest \<and> dest1 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr\<rbrace> \<and> ko_at' ko' ep_ptr \<sigma>} Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_ptr1,ptr_val (h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (IF h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))} (Guard C_Guard {s. s \<Turnstile>\<^sub>c dest1} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem \<acute>t_hrs) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL))))
ELSE
  CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_ptr1,0,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI) {s. (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> injectKOS (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, s) \<in> rf_sr} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko'. dest1 = dest2 \<and> dest2 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr and invs') \<sigma> \<and> s \<in> \<lbrace>dest2 = tcb_ptr_to_ctcb_ptr dest \<and> dest1 = tcb_ptr_to_ctcb_ptr dest \<and> ep_ptr1 = ep_Ptr ep_ptr\<rbrace> \<and> ko_at' ko' ep_ptr \<sigma>} \<subseteq> {s. s \<Turnstile>\<^sub>c dest1 \<and> s \<Turnstile>\<^sub>c ep_ptr1 \<and> is_aligned (ptr_val (h_val (hrs_mem (t_hrs_' (globals s))) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s ep_ptr1))\<lparr>epQueue_head_CL := ptr_val (h_val (hrs_mem (t_hrs_' (globals s))) (tcb_Ptr_Ptr &(dest2\<rightarrow>[''tcbEPNext_C''])))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update ep_ptr1 endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c dest1 \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c dest1 \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> injectKOS (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, s\<lparr>globals := globals s\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(dest1\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_ptr1 \<and> is_aligned 0 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t ep_ptr1))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update ep_ptr1 endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> injectKOS (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; invs' \<sigma>; ko_at' ko' ep_ptr \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> x \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> is_aligned (ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr ep_ptr)))\<lparr>epQueue_head_CL := ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' ko' ep_ptr \<sigma>; Structures_H.endpoint.RecvEP (dest # xs) = ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> x \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> is_aligned (ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr ep_ptr)))\<lparr>epQueue_head_CL := ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' ko' ep_ptr \<sigma>; Structures_H.endpoint.RecvEP (dest # xs) = ko'; valid_ep' ko' \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> x \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> is_aligned (ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr ep_ptr)))\<lparr>epQueue_head_CL := ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x y'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' ko' ep_ptr \<sigma>; Structures_H.endpoint.RecvEP (dest # xs) = ko'; valid_ep' ko' \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some ko'; cendpoint_relation (cslift x) ko' y'; cslift x (ep_Ptr ep_ptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> x \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> is_aligned (ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr ep_ptr)))\<lparr>epQueue_head_CL := ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; tcb_at' dest \<sigma>; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> is_aligned (ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; \<exists>ko ko'. ko_at' ko dest \<sigma> \<and> True \<and> cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> is_aligned (ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (h_val (hrs_mem (t_hrs_' (globals x))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = []\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP)\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))
 2. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr ep_ptr \<mapsto> endpointa)) ep_Ptr (cendpoint_relation (cslift x))
 2. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP endpointa
 2. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x = cslift x
 3. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x = cslift x
 2. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko tcb t endpoint ta endpointa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP [dest]) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP [dest]); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = []; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := 0, endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko' a list. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # xs)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # xs)); cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP (dest # xs)) y'; cslift x (ep_Ptr ep_ptr) = Some y'; \<forall>t\<in>set xs. tcb_at' t \<sigma>; dest \<notin> set xs; distinct xs; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko'; ctcb_relation ko ko'; xs = a # list\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcbEPNext_C ko')) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcbEPNext_C ko')\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (case xs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xs))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko a list tcb tcba. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_at' a \<sigma>; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba)\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr a)) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (t_hrs_' (globals t))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; ko_at' ko dest \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; tcb_at' a \<sigma>; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> (\<forall>t. (\<exists>endpointa. endpoint_lift endpointa = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; (\<sigma>, x) \<in> rf_sr; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); \<exists>koa ko'. ko_at' koa dest \<sigma> \<and> koa = ko \<and> cslift x (tcb_ptr_to_ctcb_ptr dest) = Some ko' \<and> ctcb_relation koa ko'; \<exists>ko ko'. ko_at' ko a \<sigma> \<and> True \<and> cslift x (tcb_ptr_to_ctcb_ptr a) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_Ptr_Ptr &(h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep_ptr \<and> (\<forall>t. (\<exists>endpointa. endpoint_lift endpointa = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))) (ep_Ptr ep_ptr)))\<lparr>endpoint_CL.state_CL := 0, epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))\<rparr>, x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))) \<and> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list)))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x))))
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) ((cslift x)(ep_Ptr ep_ptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> (cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba) = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) ((cslift x)(ep_Ptr ep_ptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 3. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) ((cslift x)(ep_Ptr ep_ptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) ((cslift x)(ep_Ptr ep_ptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 3. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (Structures_H.endpoint.RecvEP (a # list)) endpoint
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (dest # a # list)) \<or> isRecvEP (Structures_H.endpoint.RecvEP (dest # a # list)) then set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (dest # a # list)) \<or> isRecvEP (Structures_H.endpoint.RecvEP (dest # a # list)) then set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))) else {}))\<^esub>
 3. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 4. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ep_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (a # list) (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list))
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (dest # a # list)) \<or> isRecvEP (Structures_H.endpoint.RecvEP (dest # a # list)) then set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (dest # a # list)) \<or> isRecvEP (Structures_H.endpoint.RecvEP (dest # a # list)) then set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))) else {}))\<^esub>
 3. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 4. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (dest # a # list)) \<or> isRecvEP (Structures_H.endpoint.RecvEP (dest # a # list)) then set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (dest # a # list)) \<or> isRecvEP (Structures_H.endpoint.RecvEP (dest # a # list)) then set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))) else {}))\<^esub>
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 3. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)))
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) aa b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) a' b'
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = aa; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) aa b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) aa b
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = aa; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isSendEP (Structures_H.endpoint.RecvEP (dest # a # list)) \<or> isRecvEP (Structures_H.endpoint.RecvEP (dest # a # list))
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = aa; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))))\<^esub>
 3. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = aa; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' aa (?ntfnPtr266 \<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b') \<sigma>
 4. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = aa; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (dest # a # list))))\<^esub>
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = aa; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' aa (?ntfnPtr266 \<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b') \<sigma>
 3. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b'. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = aa; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' aa (?ntfnPtr266 \<sigma> x y' ko a list tcb tcba t endpoint koa p aa a' b b') \<sigma>
 2. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr a) (tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ep_ptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (a # list))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba)) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko a list tcb tcba t endpoint koa. \<lbrakk>dest1 = tcb_ptr_to_ctcb_ptr dest; ep_ptr1 = ep_Ptr ep_ptr; dest2 = tcb_ptr_to_ctcb_ptr dest; invs' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP (dest # a # list)) ep_ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ep_ptr = Some (Structures_H.endpoint.RecvEP (dest # a # list)); cslift x (ep_Ptr ep_ptr) = Some y'; cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; ctcb_relation ko tcb; xs = a # list; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; dest \<noteq> a; dest \<notin> set list; a \<notin> set list; distinct list; tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr dest; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr a; cslift x (tcb_ptr_to_ctcb_ptr a) = Some tcba; tcbEPPrev_C tcba = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcba); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a)\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep_ptr) endpoint) (t_hrs_' (globals x)); ko_at' ko dest \<sigma>; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); ko_at' koa a \<sigma>; ctcb_relation koa tcba; zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> (cslift x)(tcb_ptr_to_ctcb_ptr a \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) tcba) = map_option tcb_null_ep_ptrs \<circ> cslift x proof (prove)
goal:
No subgoals!