theory Ipc_C

lemma receiveIPC_enqueue_ccorres_helper:
  "ccorres dc xfdc (valid_pspace'
                and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set queue \<times> {EPRecv})))
                and st_tcb_at'  (\<lambda>st. isBlockedOnReceive st \<and>
                                      blockingObject st = epptr) thread
                and ko_at' (ep::Structures_H.endpoint) epptr
                and K ((ep = IdleEP \<and> queue = [thread]) \<or>
                       (\<exists>q. ep = RecvEP q \<and> thread \<notin> set q \<and>
                            queue = q @ [thread])))
           UNIV hs
           (setEndpoint epptr (Structures_H.endpoint.RecvEP queue))
           (\<acute>queue :== CALL ep_ptr_get_queue(ep_Ptr epptr);;
            (\<acute>queue :== CALL tcbEPAppend(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
             (CALL endpoint_ptr_set_state(ep_Ptr epptr, scast EPState_Recv);;
              CALL ep_ptr_set_queue(ep_Ptr epptr,\<acute>queue))))" unfolding K_def apply (rule ccorres_gen_asm) apply (rule ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp split del: if_split) apply (frule cmap_relation_ep) apply (erule (1) cmap_relation_ko_atE) apply (rule conjI) apply (erule h_t_valid_clift) apply (frule(1) st_tcb_at_h_t_valid) apply (frule pred_tcb_at') apply (rule impI) apply (rule_tac x="init queue" in exI) apply (frule(1) ko_at_valid_ep' [OF _ valid_pspace_valid_objs']) apply (frule is_aligned_tcb_ptr_to_ctcb_ptr) apply (rule conjI) apply (rule_tac x=\<sigma> in exI) apply (simp add: cendpoint_relation_def Let_def) apply (case_tac ep, simp_all add: init_def valid_ep'_def)[1] apply (subgoal_tac "sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace :=
                          (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (RecvEP queue))\<rparr>))") prefer 2 apply (clarsimp simp: state_refs_of'_upd ko_wp_at'_def
                         obj_at'_def projectKOs objBitsKO_def) apply (subgoal_tac "ko_at' (RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace :=
                          (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (RecvEP queue))\<rparr>)") prefer 2 apply (clarsimp simp: obj_at'_def projectKOs objBitsKO_def ps_clear_upd) apply (intro conjI impI allI) apply (fastforce simp: h_t_valid_clift) apply (fastforce simp: h_t_valid_clift) apply (case_tac ep, simp_all add: EPState_Idle_def EPState_Recv_def)[1]
   \<comment> \<open>RecvEP case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (simp add: setEndpoint_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def Let_def init_def
                        cpspace_relation_def update_ep_map_tos
                        typ_heap_simps') apply (elim conjE) apply (intro conjI)
             \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
           \<comment> \<open>ep relation\<close> apply (rule cpspace_relation_ep_update_ep', assumption+) apply (clarsimp simp: cendpoint_relation_def Let_def
                                  mask_def [where n=2] EPState_Recv_def
                           split: if_split) apply (fastforce simp: tcb_queue_relation'_def is_aligned_neg_mask
                                  valid_ep'_def
                            dest: tcb_queue_relation_next_not_NULL) apply (simp add: isSendEP_def isRecvEP_def)
          \<comment> \<open>ntfn relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_ep_queue, assumption+) apply (simp add: isSendEP_def isRecvEP_def) apply simp apply (frule_tac x=p in map_to_ko_atI, clarsimp, clarsimp) apply (erule(2) map_to_ko_at_updI') apply (clarsimp simp: objBitsKO_def) apply (clarsimp simp: obj_at'_def projectKOs)
         \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption
  \<comment> \<open>IdleEP case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (simp add: setEndpoint_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def init_def Let_def
                       cpspace_relation_def update_ep_map_tos
                       typ_heap_simps') apply (elim conjE) apply (intro conjI)
           \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
          \<comment> \<open>ep relation\<close> apply (rule cpspace_relation_ep_update_ep', assumption+) apply (clarsimp simp: cendpoint_relation_def Let_def
                                 mask_def [where n=2] EPState_Recv_def) apply (clarsimp simp: tcb_queue_relation'_def is_aligned_neg_mask) apply (simp add: isSendEP_def isRecvEP_def)
         \<comment> \<open>ntfn relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_ep_queue, assumption+) apply (simp add: isSendEP_def isRecvEP_def) apply simp apply (frule_tac x=p in map_to_ko_atI, clarsimp, clarsimp) apply (erule(2) map_to_ko_at_updI') apply (clarsimp simp: objBitsKO_def) apply (clarsimp simp: obj_at'_def projectKOs)
        \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: typ_heap_simps') apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set queue \<times> {EPRecv}))) and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread and ko_at' ep epptr and K (ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]))) UNIV hs (setEndpoint epptr (Structures_H.endpoint.RecvEP queue)) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set queue \<times> {EPRecv}))) and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread and ko_at' ep epptr and (\<lambda>y. ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]))) UNIV hs (setEndpoint epptr (Structures_H.endpoint.RecvEP queue)) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))) proof (prove)
goal (1 subgoal):
 1. ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]) \<Longrightarrow> ccorres dc xfdc (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set queue \<times> {EPRecv}))) and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread and ko_at' ep epptr) UNIV hs (setEndpoint epptr (Structures_H.endpoint.RecvEP queue)) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))) proof (prove)
goal (1 subgoal):
 1. ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]) \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set queue \<times> {EPRecv}))) and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread and ko_at' ep epptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Recv);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue))) {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]) \<Longrightarrow> {s. (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set queue \<times> {EPRecv}))) and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread and ko_at' ep epptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))) \<longrightarrow> (\<exists>queuea. (\<exists>ta. (ta, tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) s)) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb ta) \<and> distinct queuea \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread)) ta \<and> ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) \<notin> set queuea \<and> ep_queue_relation' (cslift s) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))) = NULL then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread)]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) # queuea))\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) # queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals s)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))) = NULL then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). (\<sigma>', s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>))))))))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rbrakk> \<Longrightarrow> \<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb \<sigma>) \<and> distinct (init queue) \<and> tcb_at' thread \<sigma> \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))); x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> (\<forall>tcb\<in>set (init queue). tcb_at' tcb \<sigma>) \<and> distinct (init queue) \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')))
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>))
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>))\<rbrakk> \<Longrightarrow> ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>))\<rbrakk> \<Longrightarrow> ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)
 2. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>tb. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr
 3. \<And>\<sigma> x ko' t ta tb. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr epptr
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb. \<lbrakk>ep = Structures_H.endpoint.IdleEP \<and> queue = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.RecvEP q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := set queue \<times> {EPRecv})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' ep epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) ep ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))); valid_ep' ep \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP queue) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP queue))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP queue) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1. \<lbrakk>thread \<notin> set x1 \<and> queue = x1 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x1 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject epptr (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<sigma>). (snd xa, x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>), x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread]))))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread]))))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread]))))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread]))))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread]))))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift t) (Structures_H.endpoint.RecvEP (x1 @ [thread])) ep'
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<or> isRecvEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) then set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<or> isRecvEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) then set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; endpoint_CL.state_CL (endpoint_lift ko') = 2; ep_queue_relation' (cslift x) x1 (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')))\<rbrakk> \<Longrightarrow> (epQueue_head_CL (endpoint_lift ko') = 0 \<longrightarrow> ep_queue_relation' (cslift t) (x1 @ [thread]) (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr thread)) \<and> (epQueue_head_CL (endpoint_lift ko') \<noteq> 0 \<longrightarrow> ep_queue_relation' (cslift t) (x1 @ [thread]) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_ptr_to_ctcb_ptr thread))
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<or> isRecvEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) then set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<or> isRecvEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) then set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<or> isRecvEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) then set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<or> isRecvEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) then set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isSendEP (Structures_H.endpoint.RecvEP (x1 @ [thread])) \<or> isRecvEP (Structures_H.endpoint.RecvEP (x1 @ [thread]))
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr295 \<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP (x1 @ [thread]))))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr295 \<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr295 \<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr295 \<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> objBitsKO (injectKOS (Structures_H.endpoint.RecvEP x1)) = objBitsKO (KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> epptr
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> epptr
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 8. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 8. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 7. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 5. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 4. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 3. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x1 tc endpoint ep'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := insert (thread, EPRecv) (set x1 \<times> {EPRecv}))); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) (Structures_H.endpoint.RecvEP x1) ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP (x1 @ [thread])) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [thread])))\<rparr>); ep = Structures_H.endpoint.RecvEP x1; thread \<notin> set x1; queue = x1 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x1 @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x1))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P221 \<sigma> x ko' t ta tb x1 tc endpoint ep') epptr \<sigma>
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); \<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift ta (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (t_hrs_' (globals ta)); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject epptr (Structures_H.endpoint.RecvEP [thread]) \<sigma>). (snd xa, x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS (Structures_H.endpoint.RecvEP [thread]))\<rparr>), x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread])))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread])))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread])))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread])))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread])))) ((cslift x)(ep_Ptr epptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift t) (Structures_H.endpoint.RecvEP [thread]) ep'
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP [thread]) \<or> isRecvEP (Structures_H.endpoint.RecvEP [thread]) then set (epQueue (Structures_H.endpoint.RecvEP [thread])) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP [thread]) \<or> isRecvEP (Structures_H.endpoint.RecvEP [thread]) then set (epQueue (Structures_H.endpoint.RecvEP [thread])) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP [thread]) \<or> isRecvEP (Structures_H.endpoint.RecvEP [thread]) then set (epQueue (Structures_H.endpoint.RecvEP [thread])) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP [thread]) \<or> isRecvEP (Structures_H.endpoint.RecvEP [thread]) then set (epQueue (Structures_H.endpoint.RecvEP [thread])) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' tcb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread), epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) = tcb_ptr_to_ctcb_ptr thread; cslift t (tcb_ptr_to_ctcb_ptr thread) = Some tcb; tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP [thread]) \<or> isRecvEP (Structures_H.endpoint.RecvEP [thread]) then set (epQueue (Structures_H.endpoint.RecvEP [thread])) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP (Structures_H.endpoint.RecvEP [thread]) \<or> isRecvEP (Structures_H.endpoint.RecvEP [thread]) then set (epQueue (Structures_H.endpoint.RecvEP [thread])) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isSendEP (Structures_H.endpoint.RecvEP [thread]) \<or> isRecvEP (Structures_H.endpoint.RecvEP [thread])
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP [thread])))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP [thread])))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr425 \<sigma> x ko' t ta tb tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP [thread])))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP [thread])))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr425 \<sigma> x ko' t ta tb tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr425 \<sigma> x ko' t ta tb tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr425 \<sigma> x ko' t ta tb tc endpoint ep' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> objBitsKO (injectKOS Structures_H.endpoint.IdleEP) = objBitsKO (KOEndpoint (Structures_H.endpoint.RecvEP [thread]))
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> epptr
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ntfn_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> epptr
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2, epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb tc endpoint ep'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(epptr := {(thread, EPRecv)})); st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) thread \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ep_Ptr epptr) = Some ko'; cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ep' Structures_H.endpoint.IdleEP \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>)); ko_at' (Structures_H.endpoint.RecvEP [thread]) epptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [thread]))\<rparr>); ep = Structures_H.endpoint.IdleEP; head_C (ret__struct_tcb_queue_C_' t) = (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); endpoint_lift endpoint = endpoint_lift ko'\<lparr>endpoint_CL.state_CL := 2 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t)); endpoint_lift ep' = endpoint_lift (the (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread)\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) ep') (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if epQueue_head_CL (endpoint_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P357 \<sigma> x ko' t ta tb tc endpoint ep') epptr \<sigma> proof (prove)
goal:
No subgoals!